HighPublic exploit

URL spoofing in Remix 2 / React Router 7 Express adapter

IdentifiersCVE-2025-31137CWE-20

CVE-2025-31137 is a high-severity URL spoofing vulnerability affecting Remix 2.x and React Router 7.x deployments that use the Express adapter. The flaw is caused by improper handling and insufficient sanitization of the Host and X-Forwarded-Host headers when constructing the incoming Request URL. An attacker can place a URL pathname into the port portion of a Host-related header, causing the Remix/React Router request handler to interpret a spoofed URL/path different from the actual request target. According to the provided content, affected versions include Remix prior to 2.16.3 and React Router prior to 7.4.1 when using the Express adapter.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an attacker to manipulate the URL perceived by server-side routing and application logic. Based on the provided content, this can enable route confusion, bypass of route-based security controls, incorrect redirects, cache poisoning in intermediary caches or CDNs, and phishing-style abuse where malicious behavior appears under a legitimate domain context. The vulnerability may also affect security decisions made from the interpreted request URL, particularly for sensitive endpoints such as /api/*.

Mitigation

If you can’t patch tonight, do this now.

Until patching is completed, only trust Host and X-Forwarded-Host values from trusted reverse proxies or load balancers. Strip or overwrite X-Forwarded-Host at the edge, normalize Host values, and reject malformed or unexpected host structures, especially values containing path-like content in the port section. The provided content specifically suggests proxy-layer sanitization such as setting Host and X-Forwarded-Host to the canonical $host value and monitoring for suspicious path-like patterns in these headers.

Remediation

Patch, then assume compromise.

Upgrade to fixed versions. The provided content states that the issue is patched in Remix 2.16.3 and React Router 7.4.1. For affected Express-adapter deployments, update @remix-run/express to 2.16.3 or later and @react-router/express to 7.4.1 or later, and verify that downstream URL construction and trust of forwarded headers follow the vendor's patched behavior.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

vulnerability-in-Remix-React-Router-CVE-2025-31137-MaturityPoCVerified exploit

This repository is a Capture The Flag (CTF) challenge designed to demonstrate and teach exploitation of a vulnerability in Remix React Router (CVE-2025-31137). The repository contains a sample Remix application (version 2.16.0) with instructions to patch the @remix-run/express package to a vulnerable state by replacing its server.js with a provided vulnerable version (server.ts). The main goal is to access the admin page and retrieve a flag, simulating a real-world exploitation scenario. The application is built using TypeScript, React, and Express, with entry points in 'server.js' and the Remix app files. The attack vector is network-based, targeting the HTTP server running on localhost:3000. The repository does not contain a weaponized payload but provides a proof-of-concept environment for learning and demonstrating the vulnerability. The README is comprehensive, guiding users through setup and exploitation, and references external research for further learning.

pouriam23Disclosed Apr 23, 2025typescriptjavascriptnetwork

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

React Router@React-Router/Expressapplication

React RouterExpressapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

zeropath blogNews

Apr 1, 2025

React Router Under Siege: Analyzing CVE-2025-31137 URL Spoofing Vulnerability - ZeroPath Blog | ZeroPath

A high-severity URL spoofing vulnerability in React Router 7.x and Remix 2.x applications using the Express adapter, caused by inadequate sanitization of Host and X-Forwarded-Host headers, enabling URL path manipulation, security bypass, and cache poisoning.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity4