CVE-2025-61686: Path Traversal Vulnerability in @react-router/node, @remix-run/node, and @remix-run/deno
Summary
CVE-2025-61686: React Router has Path Traversal in File Session Storage. Affects @react-router/node versions >= 7.0.0, < 7.9.4. Fixed in 7.9.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
React Router is a popular library for routing in React applications, enabling developers to create dynamic single-page applications with ease. It provides functionalities for managing navigation and rendering components based on the current URL. The affected packages, @react-router/node, @remix-run/node, and @remix-run/deno, are used for server-side rendering and session management. This vulnerability arises when these packages are used with unsigned cookies, allowing potential attackers to exploit file session storage.
Vulnerability Detail
The vulnerability allows an attacker to exploit the createFileSessionStorage() function from the affected packages. By using unsigned cookies, an attacker can manipulate the session to read or write files outside the designated session file directory. The attack's success hinges on the web server's permissions to access those files. While direct file returns to the attacker are not possible, if the file matches the expected session format, it can populate the server-side session, potentially exposing sensitive information through application logic.
How To Fix
Latest published version: 8.5.0 as of 22 Oct 2026
npm install @react-router/node@8.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.9.4
This is the first release that contains the fix.
npm install @react-router/node@7.9.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider using signed cookies instead of unsigned ones to mitigate the risk of this vulnerability. This can be done by configuring your session storage to ensure that cookies are signed, thus preventing unauthorized access to session data.
Conclusion
The vulnerability CVE-2025-61686 poses a significant risk to applications using @react-router/node, @remix-run/node, and @remix-run/deno with unsigned cookies. It is crucial to update to the latest versions of these packages and consider using signed cookies to enhance security. Regular monitoring with tools like Vulert can help maintain awareness of vulnerabilities in your software.
See every vulnerability recorded for @react-router/node →
FAQ
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can provide real-time alerts. You can also check your application using the Vulert playground without any signup.
If exploited, this vulnerability could allow attackers to access sensitive files on the server, potentially leading to data breaches or unauthorized access to session information.
To avoid this vulnerability, ensure that you are using signed cookies for session management and regularly update your packages to the latest versions.
If immediate updates are not possible, implement the workaround of using signed cookies to mitigate the risk until you can upgrade to the patched versions.
