Protection against React Router and Remix vulnerabilities
Vercel has deployed firewall protections against two high-severity vulnerabilities (CVE-2025-43864, CVE-2025-43865) in React Router that could enable cache poisoning and stored XSS attacks. Customers using affected versions are now protected, and React Router 7.5.2 patches are available.
Security researchers reviewing the Remix web framework have discovered two high-severity vulnerabilities in React Router. Vercel proactively deployed mitigation to the Vercel Firewall and .Vercel customers are protected
and enable an external party to modify the response using certain request headers, which can lead to cache poisoning Denial of Service (DoS). CVE 43865 enables vulnerabilities such as stored Cross Site Scripting (XSS).CVE-2025-43864CVE-2025-43865
When we learned about the vulnerability, we started analyzing the impact to the Vercel platform. Here are our findings and recommendations:
Both issues have been patched in React Router 7.5.2. We recommend updating to the latest version and redeploying.
If you are using additional layers of caching, including Cloudflare or other CDNs, we recommend purging those caches separately. Thank you to for disclosing the vulnerability.zhero
Impact and analysis
We were able to reproduce the vulnerability and demonstrate that cache poisoning is trivial, including stored Cross Site Scripting (XSS) injections
The only precondition is that the customer used an impacted version of Remix / React Router (v7.0.0 branch prior to version v7.5.2) and headers
Cache-ControlThe impact can extend to any visitor of the application after the cache is poisoned, regardless of authentication state or any other request headers
Vercel customers using React Router between v7.0.0 and v7.5.1 were impacted before our Firewall mitigation
We have deployed mitigations for attacks by stripping the and headers from the request in the Vercel Firewall. New requests are now protected across all deployments on the Vercel platform. We confirmed our mitigation approach with the Remix / React Router team.
X-React-Router-Spa-ModeX-React-Router-Prerender-DataIn addition to mitigating future requests, we have preemptively purged CDN response caches on our network out of caution.
Source: original entry ↗
More from Vercel
Follow Vercel to get its new changes in your feed and email digest.
OpenAI Decisions API now available on AI Gateway
OpenAI's Decisions API is now accessible through Vercel's AI Gateway with an OpenAI-compatible endpoint, enabling decision models to answer typed questions and return probabilities, choices, and scores for routing, triage, and guardrails use cases. Support is available across the OpenAI SDK, AI SDK, HTTP API, and CLI with the latest versions.
Timestamp attributes now supported in Vercel Flags
Vercel Flags now supports timestamp attributes for entities, allowing you to create time-based targeting rules. Use this feature to run limited-time campaigns, show content between specific dates, or target users based on registration date.
Glyph Cluster now available in stealth on AI Gateway
Glyph Cluster, a reasoning model for coding and long-context analysis, is now available as a stealth model on Vercel's AI Gateway for Pro and Enterprise plan teams with purchased AI Gateway credits at no cost during the stealth period. The model supports function calling, streams responses, and can be accessed via AI SDK, OpenAI-compatible APIs, and coding agents.