PatchSiren cyber security CVE debrief

CVE-2025-61686 remix-run CVE debrief

CVE-2025-61686 is a critical vulnerability in React Router, a popular router for React applications. The vulnerability affects versions 7.0.0 through 7.9.3 of @react-router/node, and prior versions of @remix-run/deno and @remix-run/node. An attacker can exploit this vulnerability to cause the session to try to read/write from a location outside the specified session file directory, potentially leading to unauthorized access to sensitive data. The success of the attack depends on the permissions of the web server process. Read files cannot be returned directly to the attacker, but session file reads can succeed if the file matches the expected session file format. The data would be populated into the server-side session but not directly returned to the attacker unless the application logic returns specific session information. This issue has been patched in @react-router/node version 7.9.4, @remix-run/deno version 2.17.2, and @remix-run/node version 2.17.2.

Vendor: remix-run
Product: react-router
CVSS: CRITICAL 9.1
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-01-10
Original CVE updated: 2026-07-15
Advisory published: 2026-01-10
Advisory updated: 2026-07-15

Who should care

Developers and administrators using React Router in their applications should be aware of this critical vulnerability. The vulnerability can lead to unauthorized access to sensitive data, and attackers can exploit it to gain access to session files. Shopify, as the vendor, has provided patches for the affected versions.

Technical summary

The vulnerability is caused by the use of an unsigned cookie in createFileSessionStorage() from @react-router/node (or @remix-run/node/@remix-run/deno in Remix v2). This allows an attacker to manipulate the session file directory, potentially leading to unauthorized access to sensitive data. The vulnerability has a CVSS score of 9.1 and is classified as CRITICAL. The affected versions are @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2.

Defensive priority

This vulnerability has a high defensive priority due to its critical CVSS score and potential impact on sensitive data. Administrators and developers should prioritize patching the affected versions to prevent exploitation.

Recommended defensive actions

Upgrade @react-router/node to version 7.9.4 or later
Upgrade @remix-run/deno to version 2.17.2 or later
Upgrade @remix-run/node to version 2.17.2 or later
Review application logic to ensure sensitive session information is not returned to attackers
Monitor session files for unauthorized access

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, its impact, and the affected versions. The source item URL provides additional information on the vulnerability, including references to mitigation and vendor references.

Sources and references

Verified primary and authoritative sources

CVE-2025-61686 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2025-61686

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2025-61686 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2025-61686

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Mitigation or vendor reference
Unverified legacy reference

URL: https://github.com/remix-run/react-router/security/advisories/GHSA-9583-h5hc-x8cw

[email protected] - Third Party Advisory
Source reference
Unverified legacy reference

URL: https://access.redhat.com/security/cve/CVE-2025-61686

0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Source reference
Unverified legacy reference

URL: https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61686.json

0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.