Protection against React Router vulnerability CVE-2025-31137
By Steven Van ·
Vercel found its platform and customers unaffected, and recommends updating to Remix 2.16.3 or React Router 7.4.1, which contain the patch.
Vercel says its platform and customers are not affected by CVE-2025-31137, a high-severity React Router vulnerability that allows URL manipulation through the Host / X-Forwarded-Host header. Security researchers found it while reviewing the Remix web framework.
Vercel gave two reasons. It uses query parameters as part of the cache key, which protects against cache poisoning driven by the _data query param. And the @vercel/remix adapter uses X-Forwarded-Host in the same way as the Express adapter, but an end user cannot send X-Forwarded-Host to a Function hosted on Vercel.
A patch is out in Remix 2.16.3 and React Router 7.4.1. Vercel recommends that customers update to the latest version.