Executive brief
React Router and Remix are popular frameworks used to build web applications. A security flaw in how these frameworks handle session files could allow an attacker to manipulate where session data is stored or read from on the server. This could lead to unauthorized data modification or service disruptions, depending on the server's configuration.
Technical details
A path traversal vulnerability exists in the createFileSessionStorage() function within @react-router/node and Remix's node/deno adapters. When an application uses this function with unsigned cookies, an attacker can provide a crafted session ID to reference files outside the intended session directory. While the attacker cannot directly view the contents of arbitrary files unless they match the session format and are exposed by application logic, they can potentially overwrite files or corrupt session data. The vulnerability is exploitable over the network without authentication. Patches are available in @react-router/node 7.9.4 and @remix-run/node/deno 2.17.2.
Affected products
- React Router @react-router/node 7.0.0 - 7.9.3
- Remix @remix-run/deno < 2.17.2
- Remix @remix-run/node < 2.17.2
Timeline
- 2026-01-08: advisory: GitHub Security Advisory published
- 2026-01-10: disclosed: CVE-2025-61686 published to NVD