CVE-2025-61686: Path Traversal in React Router Node

The core of this vulnerability lies in the createFileSessionStorage() function within React Router Node, specifically when used with unsigned cookies. An attacker can craft a malicious cookie that manipulates the file path, tricking the application into attempting to read or write files outside the designated session storage directory. The success of this attack hinges on the web server process's permissions; if the server has write access to sensitive files, the attacker could potentially modify them. This could lead to session hijacking, data breaches, or even remote code execution if the attacker can overwrite configuration files or other critical system components. The impact is amplified in environments where session data is used for authentication or authorization.

1. Reserved2025-09-29
2. Published2026-01-10
3. Modified2026-03-03
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-61686 is to immediately upgrade React Router Node to version 7.9.4 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing stricter file permission controls on the session storage directory to limit the attacker's potential impact. Additionally, implement input validation and sanitization on any user-controlled data used in file paths. Web Application Firewalls (WAFs) configured with rules to detect and block path traversal attempts can provide an additional layer of defense. Monitor application logs for unusual file access patterns that might indicate exploitation.