CVE-2025-43864

Summary

CVE-2025-43864 affects React Router, a routing library for React applications. In versions 7.2.0 through 7.5.1, an application can be forced into Single Page Application (SPA) mode by adding a header to requests. This issue poses a significant risk for applications that use Server-Side Rendering (SSR) as the switch to SPA mode results in an error that corrupts the page. If a cache system is in place, this error can be cached, leading to cache poisoning and a severe impact on application availability. This vulnerability has been addressed in version 7.5.2.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.