{"action":"Upgrade @react-router/express to 7.4.1 or later.","affected":[{"fixed":"7.4.1","introduced":"7.0.0"}],"component":"@react-router/express","cve_ids":["CVE-2025-31137"],"ecosystem":"npm","epss":0.01191,"exploited":false,"fixed_versions":["7.4.1"],"ghsa_id":"GHSA-4q56-crqp-v477","id":"tcs_01M5KF158MY48KJJNFN31KVMGG","modified_at":"2025-04-01T22:42:10.697503Z","published_at":"2025-04-01T22:23:33Z","references":["https://osv.dev/vulnerability/GHSA-4q56-crqp-v477","https://github.com/remix-run/react-router/security/advisories/GHSA-4q56-crqp-v477","https://nvd.nist.gov/vuln/detail/CVE-2025-31137","https://github.com/remix-run/react-router"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-4q56-crqp-v477","url":"https://osv.dev/vulnerability/GHSA-4q56-crqp-v477"}],"summary":"Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers"}