Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@react-router/node

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.1npmAmendedPublished

    React Router has Path Traversal in File Session Storage

    CVE-2025-61686 · GHSA-9583-h5hc-x8cw

    Affected
    • npm @react-router/node >= 7.0.0, <= 7.9.3
    Fixed in
    7.9.4· Vendor fix available
    Issue
    If applications use createFileSessionStorage() from @react-router/node (or @remix-run/node/@remix-run/deno in Remix v2) with an unsigned cookie, it is possible for an attacker to cause the session to try to read/write from a location outside the specified session file directory. The success of the attack would depend on the permissions of the web server process to access those files. Read files cannot be returned directly to the attacker. Session file reads would only succeed if the file matched the expected session file format. If the file matched the session file format, the data would be populated into the server side session but not directly returned to the attacker unless the application logic returned specific session information.

    Recommended action: Upgrade to 7.9.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →