CVE-2025-31137: React Router Auth Bypass Vulnerability

CVE-2025-31137 Overview

CVE-2025-31137 is a request handling vulnerability affecting React Router 7 and Remix 2 applications that use the Express adapter. Attackers can spoof the URL of an incoming Request by injecting a URL pathname into the port section of a Host or X-Forwarded-Host header. The handler parses the manipulated header and constructs a Request object with an attacker-controlled URL. This bypasses URL-based routing, validation, and security logic that downstream code relies on. The issue is classified as HTTP request smuggling-class behavior under [CWE-444]. Maintainers patched the flaw in Remix 2.16.3 and React Router 7.4.1.

Critical Impact

Remote attackers can manipulate request URLs without authentication, enabling routing bypass, cache poisoning, and denial of service against applications using the Express adapter.

Affected Products

• Remix versions prior to 2.16.3 using the Express adapter
• React Router versions 7.0.0 through 7.4.0 using the Express adapter
• Node.js applications consuming @remix-run/express or @react-router/express

Discovery Timeline

• 2025-04-01 - CVE-2025-31137 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-31137

Vulnerability Analysis

The Express adapter for Remix and React Router constructs a Fetch API Request object from the incoming Express request. To build the URL, the adapter reads the Host header, or X-Forwarded-Host when the application trusts upstream proxies. The adapter does not strictly validate the structure of these headers before assembling the URL string.

An attacker can place arbitrary characters, including path separators, after the colon that normally introduces the port. When the resulting string is passed to the URL parser, the parser interprets the injected pathname as part of the URL path rather than the host authority. The handler then dispatches routing and loader logic based on the attacker-supplied path.

Downstream code that reads request.url to enforce access control, select routes, or generate cache keys receives the spoofed value. This breaks the integrity of HTTP request processing as described in [CWE-444].

Root Cause

The root cause is improper parsing and validation of the Host and X-Forwarded-Host headers when synthesizing the Request URL. The adapter trusts client-supplied header content and inserts it directly into URL construction without rejecting malformed authority components.

Attack Vector

Exploitation requires only a single HTTP request to a vulnerable endpoint. The attacker sends a request with a crafted Host or X-Forwarded-Host header containing a port value followed by a pathname. No authentication, user interaction, or prior access is required. The attack succeeds over the network against any reachable Remix or React Router endpoint using the Express adapter.

Technical details and the patched code are documented in the GitHub Security Advisory GHSA-4q56-crqp-v477.

Detection Methods for CVE-2025-31137

Indicators of Compromise

• HTTP requests with Host or X-Forwarded-Host headers containing a colon followed by non-numeric characters such as / or path segments
• Application logs showing request.url values whose host or port portion contains unexpected pathname characters
• Unexpected 404, 500, or routing errors correlated with malformed host headers from a single source IP

Detection Strategies

• Inspect reverse proxy and web application firewall logs for Host and X-Forwarded-Host header values that do not match the pattern hostname or hostname:port where port is numeric
• Add server-side logging of the reconstructed request.url for every incoming request and alert on URLs whose authority component contains /
• Run dependency scanning across CI pipelines to flag @remix-run/express below 2.16.3 and @react-router/express below 7.4.1

Monitoring Recommendations

• Forward web server access logs and Node.js application logs to a centralized analytics platform for header anomaly queries
• Baseline normal Host header values per environment and alert on deviations
• Monitor for spikes in routing errors or unauthorized route access attempts following deployments

How to Mitigate CVE-2025-31137

Immediate Actions Required

• Upgrade Remix to version 2.16.3 or later
• Upgrade React Router to version 7.4.1 or later
• Audit any custom request handlers that read Host or X-Forwarded-Host and validate header format before use
• Configure upstream reverse proxies to strip or overwrite client-supplied X-Forwarded-Host headers

Patch Information

The maintainers released fixes in Remix 2.16.3 and React Router 7.4.1. The patched adapter validates the header structure before constructing the Request URL. Review the GitHub Security Advisory for the upstream commit and version metadata.

Workarounds

• Deploy a reverse proxy rule that rejects requests whose Host or X-Forwarded-Host header contains characters outside the allowed hostname and port grammar
• Override the URL construction in a custom Express middleware that sets req.headers.host to a known trusted value before invoking the Remix or React Router handler
• Restrict the application to a fixed hostname allowlist enforced at the load balancer layer

# Upgrade vulnerable packages to patched versions
npm install @remix-run/express@^2.16.3
npm install @react-router/express@^7.4.1

# Verify installed versions
npm ls @remix-run/express @react-router/express