Description
We received a report about a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter.
Recommendation
Update the @remix-run/express package to the latest compatible version. Followings are version details:
- Affected version(s): >= 2.11.1, < 2.16.3
- Patched version(s): 2.16.3
References
Could your website be exposed too?
SmartScanner can check your website for Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers and gives you actionable findings to investigate.
Start a free scanRelated Issues
- webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior - CVE-2025-68458
- React Router has XSS Vulnerability - CVE-2025-59057
- React Router has Path Traversal in File Session Storage - CVE-2025-61686
- Trix allows Cross-site Scripting via `javascript:` url in a link - CVE-2025-21610
You might also like:
See something that needs correcting? Let us knowUpdated April 01, 2025