CVE-2025-43864

React Router versions 7.2.0 up to (but not including) 7.5.2 contain a flaw (CWE-755) that lets an attacker force an application out of server-side rendering (SSR) into single-page-app (SPA) mode by adding a specific header to an HTTP request. The forced mode switch triggers a rendering error that completely corrupts the returned page, and no privileges or user interaction are required, so any unauthenticated remote request can trigger it. If the application sits behind a cache (CDN, reverse proxy, or similar), the corrupted error response gets cached, poisoning the cache and breaking pages for all subsequent visitors until the cache expires or is purged, yielding a severe availability-only denial of service (CVSS 7.5 High, C:N/I:N/A:H). Only React Router 7.x deployments using SSR are affected; the advisory does not cover older React Router v6 releases or SPA-only usage. The issue is fixed in 7.5.2; no public proof-of-concept or confirmed in-the-wild exploitation is known, but EPSS puts the 30-day exploitation probability at about 20% (97th percentile), so patching urgency is elevated.

What to do: Upgrade to React Router 7.5.2 or later. As interim mitigation, at your CDN/reverse proxy strip or normalize the SPA-mode request header and ensure error responses are not cached (bypass cache or use very short TTLs on errors), and purge caches if corrupted responses have already been stored. Confirm whether your app runs React Router 7.2.0-7.5.1 with SSR behind a cache; pure SPA-mode usage is not affected.