CVE-2025-61686
CriticalCVSS 9.1Exploitation Probability (EPSS)
Very high risk97th percentile - higher than 97% of all known CVEs
Summary
In React Router and Remix Run libraries, a vulnerability allows reading/writing session files outside the specified directory when using createFileSessionStorage() with an unsigned cookie. An attacker can cause the session to access locations outside the intended session file directory, depending on web server process permissions.
Risk Assessment
The risk involves potential unauthorized access to session files outside the intended directory, which could lead to session data leakage or manipulation if the application returns session information in responses.
Recommendation
Immediately update libraries: @react-router/node to version 7.9.4, @remix-run/deno to version 2.17.2, and @remix-run/node to version 2.17.2. Additionally, use signed cookies for file-based sessions.
Other vulnerabilities in React Router
See all- CVE-2026-55685High
Vulnerability in React Router versions 7.0.0 through 7.17.0. Unauthenticated requests to the manifest endpoint can overload the server and slow down responses. This does not affect applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).
- CVE-2026-53669Medium
React Router versions 6.0.0 through 7.17.0 are vulnerable to Open Redirect through use of backslashes in <Link> and useNavigate. This issue has been fixed in version 7.18.0.
- CVE-2026-53668Medium
React Router versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0 are vulnerable to XSS in applications that allow open redirects. An attacker could craft a malicious link that redirects users to an unexpected external site or exploits an XSS vector. This issue has been fixed in version 7.13.0.
- CVE-2026-53667Medium
React Router versions 7.11.0 through 7.17.0 are missing protocol validation in RSCErrorHandler, allowing redirects from untrusted sources. This only affects applications using unstable RSC APIs. Fixed in version 7.18.0.
- CVE-2026-53666Medium
React Router versions 6.4.0 through 7.17.0 allow unexpected constructor execution on the client if application code allows attacker-supplied input to overwrite certain aspects of SSR errors. This can trigger an outbound network request. Only affects Framework Mode and Data Mode applications performing manual SSR/hydration. Fixed in version 7.18.0.
- CVE-2026-53663Low
React Router versions from 7.12.0 to 7.15.1 had insufficient CSRF checks in Framework Mode that operated on POST requests but were bypassed on PUT/PATCH/DELETE requests. This vulnerability is fixed in version 7.15.1.
- CVE-2026-42342High
React Router versions 7.0.0 through 7.14.x and @remix-run/server-runtime versions 2.10.0 through 2.17.4 contain a DoS vulnerability via unbounded path expansion in the __manifest endpoint. Attackers can send crafted requests that consume excessive server resources.
- CVE-2026-42211High
React Router versions 7.0.0 through 7.14.1 in Framework Mode can allow remote code execution (RCE) via external requests if the application has an existing prototype pollution vulnerability. Two-step attack. Does not affect Declarative or Data Mode.
- CVE-2026-40181Medium
React Router versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3 contain an open redirect vulnerability where certain URLs passed to the redirect function can be reinterpreted as protocol-relative URLs, redirecting to an external domain.
- CVE-2026-34077High
Client-side Cross-Site Scripting (XSS) vulnerability in React Router versions 7.7.0 through 7.13.1, occurring during RSC redirect handling from untrusted sources. Only affects applications using unstable RSC APIs.
Original NVD description (English source)
React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage() is being used from @react-router/node (or @remix-run/node/@remix-run/deno in Remix v2) with an unsigned cookie, it is possible for an attacker to cause the session to try to read/write from a location outside the specified session file directory. The success of the attack would depend on the permissions of the web server process to access those files. Read files cannot be returned directly to the attacker. Session file reads would only succeed if the file matched the expected session file format. If the file matched the session file format, the data would be populated into the server side session but not directly returned to the attacker unless the application logic returned specific session information. This issue has been patched in @react-router/node version 7.9.4, @remix-run/deno version 2.17.2, and @remix-run/node version 2.17.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS