Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers
- Severity:
- High
Description
We received a report about a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter.
Recommendation
Update the @remix-run/express package to the latest compatible version. Followings are version details:
- Affected version(s): >= 2.11.1, < 2.16.3
- Patched version(s): 2.16.3
References
Related Issues
- Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components - CVE-2025-1647
- Sending a GET or HEAD request with a body crashes SvelteKit (GHSA-g5m6-hxpp-fc49) - CVE-2024-23641
- msgpackr's conversion of property names to strings can trigger infinite recursion - CVE-2023-52079
- Trigger `beforeFind` not invoked in internal query pipeline when fetching pointer - CVE-2023-41058
- Tags:
- npm
- @remix-run/express
Anything's wrong? Let us know Last updated on April 01, 2025