-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability centers on improper handling of Host/X-Forwarded-Host headers when constructing request URLs in Express adapters. The primary vulnerable functions are the request handlers that process incoming requests and derive URL components from headers. createRequestHandler is the entry point for both affected packages, making it the most likely location for header processing flaws. getServerAddress is included as a secondary candidate based on typical Express adapter patterns for URL construction. The high confidence stems from the explicit advisory references to Express adapter handling and the CVSS vector indicating network-based exploitation of request processing logic.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @react-router/express | npm | >= 7.0.0, < 7.4.1 | 7.4.1 |
| @remix-run/express | npm | >= 2.11.1, < 2.16.3 | 2.16.3 |