Critical React Router Flaws: CVE-2025-61686 Exposes Server Files

Developers relying on the popular React Router library are being urged to patch their applications immediately following the disclosure of multiple high-severity vulnerabilities, led by CVE-2025-61686 which carries a CVSS score of 9.1.

The flaw resides in the createFileSessionStorage() method used in @react-router/node and legacy Remix packages, and can occur when unsigned cookies are used for session storage, potentially allowing an attacker to cause the session to read or write from a location outside the specified session file directory.

Although the vulnerability does not instantly dump file contents, it creates a dangerous primitive that could lead to exposure if an attacker can manipulate the session ID to reference a sensitive file, such as a configuration file, that matches the session format. Affected versions include @react-router/node 7.0.0 through 7.9.3 and @remix-run/deno up to 2.17.1, with patches released and safe versions generally starting at 7.12.0 or 7.9.6 depending on the vulnerability addressed.

The update also addresses three high-severity XSS flaws (CVE-2025-59057, CVSS 7.6; CVE-2025-59057’s related issue; CVE-2026-22029, CVSS 8.0) alongside two medium-severity logic flaws (CVE-2026-22030 and CVE-2025-68470), and the article notes that these issues heavily impact users of Remix Framework and react-router in Framework Mode, with guidance to compare versions against the advisory. According to the security advisory, patches are in place for the affected components.