Skip to main content
CRITICAL

CVE-2025-61686

CVSS v3

9.1

CRITICAL

EPSS Score

17.6 %

exploit probability, as of 2026-09-25

CISA KEV

No

known exploited

Exploitation

—

SSVC status

Description

React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage() is being used from @react-router/node (or @remix-run/node/@remix-run/deno in Remix v2) with an unsigned cookie, it is possible for an attacker to cause the session to try to read/write from a location outside the specified session file directory. The success of the attack would depend on the per

Technical details

Published
2026-01-10
Last Modified
2026-02-04

Frequently asked questions

What is CVE-2025-61686?

React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage() is being used from @react-router/node (or @remix-run/node/@remix-run/deno in Remix v2) with an unsigned cookie, it is possible for an attacker to cause the session to try to read/write from a location outside the specified session file directory. The success of the attack would depend on the per

Is CVE-2025-61686 actively exploited?

Active exploitation of CVE-2025-61686 has not been confirmed. Its EPSS score was 17.6% on 2026-09-25, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2025-61686?

CVE-2025-61686 has a CVSS v3 base score of 9.1 (CRITICAL severity).

Is CVE-2025-61686 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.

Check an IPSearch CVEsSIEM & TIP integrations

No credit card required · 500 free checks/month · Free API key

Other 2025 vulnerabilities worth triaging

Ranked by exploit probability (EPSS).

Back to CVE Database