Priority reviewCritical

CVE-2025-61686

remix-run react-router, Cryostat 4, Gatekeeper 3

React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage() is being used from @react-router/node (or @remix-run/node/@remix-run/deno in Remix v2) with an unsigned cookie, it is possible for an attacker to cause the session to try to read/write from a location outside the specified session file directory. The success of the attack would depend on the permissions of the web server process to access those files. Read files cannot be returned directly...

CVSS: 9.1
EPSS: 15.9%
CISA KEV: Not listed
Published: 2026.01.10

PRIORITY ASSESSMENT

Priority review

FIRST EPSS indicates an elevated probability of exploitation.

Known exploitationNot established by KEV

Exploit probability15.9%

Technical severityCVSS 9.1

Vulnerability overview

Affected product and versions

Product: remix-run react-router, Cryostat 4, Gatekeeper 3
Affected versions: >= @react-router/node >= 7.0.0, < 7.9.4, >= @remix-run/deno < 2.17.2, >= @remix-run/node < 2.17.2, >= 7.0.0 < 7.9.4, < 2.17.2
Fixed versions: 7.9.4, 2.17.2

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that remix-run react-router, Cryostat 4, Gatekeeper 3 and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CWE: CWE-22