Skip to main content

Insufficient Verification of Data Authenticity

CVE-2025-43865

High
8.2/10

Summary

The package react-router is a routing library for React applications. In versions 7.0.x prior to 7.5.2, it was possible to modify pre-rendered data by adding a specific header to the request. This allowed for the complete spoofing of its contents and modification of all values in the data object passed to the HTML.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-345 - Insufficient Verification of Data Authenticity

The software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

References

Advisory Timeline

  • Published