{"action":"Upgrade @remix-run/express to 2.16.3 or later.","affected":[{"fixed":"2.16.3","introduced":"2.11.1"}],"component":"@remix-run/express","cve_ids":["CVE-2025-31137"],"ecosystem":"npm","epss":0.01191,"exploited":false,"fixed_versions":["2.16.3"],"ghsa_id":"GHSA-4q56-crqp-v477","id":"tcs_01M5KF15G37FA82PFA769K23FR","modified_at":"2025-04-01T22:42:10.697503Z","published_at":"2025-04-01T22:23:33Z","references":["https://osv.dev/vulnerability/GHSA-4q56-crqp-v477","https://github.com/remix-run/react-router/security/advisories/GHSA-4q56-crqp-v477","https://nvd.nist.gov/vuln/detail/CVE-2025-31137","https://github.com/remix-run/react-router"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-4q56-crqp-v477#npm/@remix-run/express","url":"https://osv.dev/vulnerability/GHSA-4q56-crqp-v477"}],"summary":"Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers"}