Protection against React Router and Remix vulnerabilities
By Steven Van ·
Vercel's Firewall now strips two React Router headers, and it recommends upgrading to 7.5.2 and purging any other CDN caches you run.
Vercel has added a Vercel Firewall mitigation for two high-severity React Router vulnerabilities, CVE-2025-43864 and CVE-2025-43865. Vercel says its customers are protected. Both flaws let an outside party alter a response using certain request headers, which can lead to cache poisoning and denial of service. CVE-2025-43865 also enables issues such as stored cross-site scripting (XSS).
Vercel reproduced the problem and found cache poisoning to be trivial, including stored XSS injection. The only preconditions are an affected version of Remix / React Router (the v7.0.0 branch before v7.5.2) and Cache-Control headers. Once the cache is poisoned, any visitor can be affected, whatever their authentication state or other request headers. Customers on React Router v7.0.0 to v7.5.1 were exposed before the mitigation went in.
- The Firewall now strips the X-React-Router-Spa-Mode and X-React-Router-Prerender-Data headers from incoming requests, across all deployments on the platform.
- Vercel confirmed the approach with the Remix / React Router team.
- As a precaution, it also purged CDN response caches on its network.
Both issues are patched in React Router 7.5.2, and Vercel recommends updating to the latest version and redeploying. Anyone running extra caching layers, such as Cloudflare or other CDNs, should purge those caches separately. Vercel credits zhero with disclosing the vulnerability.