Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@remix-run/express

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5npmAmendedPublished

    Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers

    CVE-2025-31137 · GHSA-4q56-crqp-v477

    Affected
    • npm @remix-run/express >= 2.11.1, < 2.16.3
    Fixed in
    2.16.3· Vendor fix available
    Issue
    Impact We received a report about a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an incoming Request by putting a URL pathname in the port section of a URL that is part of a Host or X-Forwarded-Host header sent to a Remix/React Router request handler. Patches This issue has been patched and released in Remix 2.16.3 React Router 7.4.1. Credits - Rachid Allam (zhero;) - Yasser Allam (inzo)

    Recommended action: Upgrade to 2.16.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →