CVE-2025-31137 is a URL spoofing vulnerability affecting Remix 2 and React Router 7 when using the Express adapter. This vulnerability allows attackers to manipulate the URL used in incoming requests by injecting a pathname into the port section of a Host or X-Forwarded-Host header. With a CVSS score of 7.5 and an SVRS of 78, this vulnerability is considered high severity and requires prompt attention. Although not critical (SVRS > 80), the potential for URL spoofing can lead to various exploits, including unauthorized access and data manipulation. Update to Remix 2.16.3 or React Router 7.4.1 to mitigate this security risk. This issue highlights the importance of validating headers in web applications to prevent malicious manipulation. The patch addresses the improper handling of URL pathnames in the host header.