Protection against React Router vulnerability CVE-2025-31137
A high-severity vulnerability in React Router allowing URL manipulation through the X-Forwarded-Host header has been patched in Remix 2.16.3 and React Router 7.4.1. Vercel customers are protected by default due to query parameter-based cache keying, but updating to the latest version is recommended.
Security researchers reviewing the Remix web framework have a high-severity vulnerability in React Router that allows URL manipulation through the / header. recently discoveredHostX-Forwarded-Host
Our investigation determined that Vercel and our customers are unaffected:
A patch has been issued and released in Remix 2.16.3 / React Router 7.4.1. We recommend customers update to the latest version.
Read more about .CVE-2025-31137
We use query parameters as part of the cache key, which protects against cache poisoning driven by the query praram.
_dataThe adapter uses similarly to the Express adapter, but it is not possible for an end user to send to a Function hosted on Vercel.
@vercel/remixX-Forwarded-HostX-Forwarded-Host
Source: original entry ↗
More from Vercel
Follow Vercel to get its new changes in your feed and email digest.
OpenAI Decisions API now available on AI Gateway
OpenAI's Decisions API is now accessible through Vercel's AI Gateway with an OpenAI-compatible endpoint, enabling decision models to answer typed questions and return probabilities, choices, and scores for routing, triage, and guardrails use cases. Support is available across the OpenAI SDK, AI SDK, HTTP API, and CLI with the latest versions.
Timestamp attributes now supported in Vercel Flags
Vercel Flags now supports timestamp attributes for entities, allowing you to create time-based targeting rules. Use this feature to run limited-time campaigns, show content between specific dates, or target users based on registration date.
Glyph Cluster now available in stealth on AI Gateway
Glyph Cluster, a reasoning model for coding and long-context analysis, is now available as a stealth model on Vercel's AI Gateway for Pro and Enterprise plan teams with purchased AI Gateway credits at no cost during the stealth period. The model supports function calling, streams responses, and can be accessed via AI SDK, OpenAI-compatible APIs, and coding agents.