# Protection against React Router vulnerability CVE-2025-31137

By Steven Van · 2025-04-17

Vercel found its platform and customers unaffected, and recommends updating to Remix 2.16.3 or React Router 7.4.1, which contain the patch.

Vercel says its platform and customers are not affected by [CVE-2025-31137](<https://vercel.com/changelog/protection-against-react-router-vulnerability-cve-2025-31137>), a high-severity React Router vulnerability that allows URL manipulation through the Host / X-Forwarded-Host header. Security researchers found it while reviewing the Remix web framework.

[Vercel](<https://creatorstoolbox.com/tools/vercel>) gave two reasons. It uses query parameters as part of the cache key, which protects against cache poisoning driven by the \_data query param. And the @vercel/remix adapter uses X-Forwarded-Host in the same way as the Express adapter, but an end user cannot send X-Forwarded-Host to a Function hosted on Vercel.

A patch is out in **Remix 2.16.3** and **React Router 7.4.1**. Vercel recommends that customers update to the latest version.

![Vercel](<https://www.google.com/s2/favicons?domain=vercel.com&sz=128>)

Vercel

The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config.

[View Vercel →](<https://creatorstoolbox.com/tools/vercel>)

[Original source](<https://vercel.com/changelog/protection-against-react-router-vulnerability-cve-2025-31137>)

[Read Protection against React Router vulnerability CVE-2025-31137 on Creators Toolbox](<https://creatorstoolbox.com/blog/vercel-protection-against-react-router-vulnerability-cve-2025-31137>)

---
Canonical source: https://creatorstoolbox.com/blog/vercel-protection-against-react-router-vulnerability-cve-2025-31137