PatchSiren cyber security CVE debrief

CVE-2025-59057 remix-run CVE debrief

CVE-2025-59057 is a high-severity XSS vulnerability affecting React Router's meta()/<Meta> APIs in Framework Mode. The issue exists in @remix-run/react versions 1.15.0 through 2.17.0 and react-router versions 7.0.0 through 7.8.2. An attacker could exploit this vulnerability to execute arbitrary JavaScript during Server-Side Rendering (SSR) if untrusted content is used to generate script:ld+json tags. The vulnerability has been patched in @remix-run/react version 2.17.1 and react-router version 7.9.0. There is no impact if the application is being used in Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).

Vendor: remix-run
Product: react-router
CVSS: HIGH 7.6
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-01-10
Original CVE updated: 2026-07-15
Advisory published: 2026-01-10
Advisory updated: 2026-07-15

Who should care

Developers using React Router in Framework Mode with @remix-run/react versions 1.15.0 through 2.17.0 or react-router versions 7.0.0 through 7.8.2 should be aware of this XSS vulnerability. Additionally, security teams and administrators responsible for maintaining applications that utilize these affected versions should prioritize patching to prevent potential attacks.

Technical summary

The vulnerability exists in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags. This could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag. The CVSS score for this vulnerability is 7.6, indicating a high severity. The vulnerability is patched in @remix-run/react version 2.17.1 and react-router version 7.9.0. Affected CPE criteria include cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:* (version 7.0.0 through 7.8.2) and cpe:2.3:a:shopify:remix-run/react:*:*:*:*:*:node.js:*:* (version 1.15.0 through 2.17.0).

Defensive priority

This vulnerability should be prioritized for patching due to its high severity and potential for exploitation. Developers should update to @remix-run/react version 2.17.1 or react-router version 7.9.0 as soon as possible.

Recommended defensive actions

Update to @remix-run/react version 2.17.1 or later
Update to react-router version 7.9.0 or later
Review application usage of React Router's meta()/<Meta> APIs in Framework Mode
Ensure untrusted content is not used to generate script:ld+json tags
Consider using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) if possible

Evidence notes

The CVE record and NVD detail provide official information about the vulnerability. Additional references from Red Hat and GitHub offer further context and mitigation strategies. The CVE was published on January 10, 2026, and last modified on June 30, 2026.

Sources and references

Verified primary and authoritative sources

CVE-2025-59057 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2025-59057

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2025-59057 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2025-59057

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Mitigation or vendor reference
Unverified legacy reference

URL: https://github.com/remix-run/react-router/security/advisories/GHSA-3cgp-3xvw-98x8

[email protected] - Third Party Advisory
Source reference
Unverified legacy reference

URL: https://access.redhat.com/errata/RHSA-2026:19712

0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Source reference
Unverified legacy reference

URL: https://access.redhat.com/errata/RHSA-2026:3782

0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Source reference
Unverified legacy reference

URL: https://access.redhat.com/errata/RHSA-2026:3958

0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Source reference
Unverified legacy reference

URL: https://access.redhat.com/errata/RHSA-2026:3960

0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Source reference
Unverified legacy reference

URL: https://access.redhat.com/security/cve/CVE-2025-59057

0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.