Every CVE Search/ Get API key

CVE-2025-61686

React Router has Path Traversal in File Session Storage

9.1 CriticalPublic exploitFix available

React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage() is being used from @react-router/node (or @remix-run/node/@remix-run/deno in Remix v2) with an unsigned cookie, it is possible for an attacker to cause the session to try to read/write from a location outside the specified session file directory. The success of the attack would depend on the permissions of the web server process to access those files. Read files cannot be returned directly to the attacker. Session file reads would only succeed if the file matched the expected session file format. If the file matched the session file format, the data would be populated into the server side session but not directly returned to the attacker unless the application logic returned specific session information. This issue has been patched in @react-router/node version 7.9.4, @remix-run/deno version 2.17.2, and @remix-run/node version 2.17.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
High

Exploit likelihood

17.3%Up 17.3 points since Jan 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.1

React Router has Path Traversal in File Session Storage

React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage() is being used from @react-router/node (or @remix-run/node/@remix-run/deno in Remix v2) with an unsigned cookie, it is possible for an attacker to cause the session to try to read/write from a location outside the specified session file directory. The success of the attack would depend on the permissions of the web server process to access those files. Read files cannot be returned directly to the attacker. Session file reads would only succeed if the file matched the expected session file format. If the file matched the session file format, the data would be populated into the server side session but not directly returned to the attacker unless the application logic returned specific session information. This issue has been patched in @react-router/node version 7.9.4, @remix-run/deno version 2.17.2, and @remix-run/node version 2.17.2.

Record
CVE-2025-61686
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-22, CWE-22
Updated
2026-11-02
EUVDEUVD-2026-1468 9.1

React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage() is being used from @react-router/node (or @remix-run/node/@remix-run/deno in Remix v2) with an unsigned cookie, it is possible for an attacker to cause the session to try to read/write from a location outside the specified session file directory. The success of the attack would depend on the permissions of the web server process to access those files. Read files cannot be returned directly to the attacker. Session file reads would only succeed if the file matched the expected session file format. If the file matched the session file format, the data would be populated into the server side session but not directly returned to the attacker unless the application logic returned specific session information. This issue has been patched in @react-router/node version 7.9.4, @remix-run/deno version 2.17.2, and @remix-run/node version 2.17.2.

Record
EUVD-2026-1468
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-9583-h5hc-x8cw 9.1

React Router has Path Traversal in File Session Storage

If applications use createFileSessionStorage() from @react-router/node (or @remix-run/node/@remix-run/deno in Remix v2) with an unsigned cookie, it is possible for an attacker to cause the session to try to read/write from a location outside the specified session file directory. The success of the attack would depend on the permissions of the web server process to access those files.

Read files cannot be returned directly to the attacker. Session file reads would only succeed if the file matched the expected session file format. If the file matched the session file format, the data would be populated into the server side session but not directly returned to the attacker unless the application logic returned specific session information.

Record
GHSA-9583-h5hc-x8cw
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
NVD 9.1

React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage() is being used from @react-router/node (or @remix-run/node/@remix-run/deno in Remix v2) with an unsigned cookie, it is possible for an attacker to cause the session to try to read/write from a location outside the specified session file directory. The success of the attack would depend on the permissions of the web server process to access those files. Read files cannot be returned directly to the attacker. Session file reads would only succeed if the file matched the expected session file format. If the file matched the session file format, the data would be populated into the server side session but not directly returned to the attacker unless the application logic returned specific session information. This issue has been patched in @react-router/node version 7.9.4, @remix-run/deno version 2.17.2, and @remix-run/node version 2.17.2.

Record
CVE-2025-61686
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
OSV 9.1

React Router has Path Traversal in File Session Storage

React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage() is being used from @react-router/node (or @remix-run/node/@remix-run/deno in Remix v2) with an unsigned cookie, it is possible for an attacker to cause the session to try to read/write from a location outside the specified session file directory. The success of the attack would depend on the permissions of the web server process to access those files. Read files cannot be returned directly to the attacker. Session file reads would only succeed if the file matched the expected session file format. If the file matched the session file format, the data would be populated into the server side session but not directly returned to the attacker unless the application logic returned specific session information. This issue has been patched in @react-router/node version 7.9.4, @remix-run/deno version 2.17.2, and @remix-run/node version 2.17.2.

Record
CVE-2025-61686
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
OSVGHSA-9583-h5hc-x8cw 9.1

React Router has Path Traversal in File Session Storage

If applications use createFileSessionStorage() from @react-router/node (or @remix-run/node/@remix-run/deno in Remix v2) with an unsigned cookie, it is possible for an attacker to cause the session to try to read/write from a location outside the specified session file directory. The success of the attack would depend on the permissions of the web server process to access those files.

Read files cannot be returned directly to the attacker. Session file reads would only succeed if the file matched the expected session file format. If the file matched the session file format, the data would be populated into the server side session but not directly returned to the attacker unless the application logic returned specific session information.

Record
GHSA-9583-h5hc-x8cw
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
Show 19 moreShow less
OSVCLSA-2026-1775521863 No score

TuxCare security update for @remix-run (1 CVE)

TuxCare rebuilt 2 @remix-run packages to address 1 CVE. Fixed in 2.17.0-tuxcare.1.

Record
CLSA-2026-1775521863
Updated
2026-11-02
OSVCLSA-2026-1784856210 No score

TuxCare security update for 2 packages (3 CVEs)

TuxCare rebuilt 2 packages to address 3 CVEs. Fixed in 7.5.1-tuxcare.5.

Record
CLSA-2026-1784856210
Updated
2026-11-02
OSVCLSA-2026-1790461041 No score

TuxCare security update for @remix-run (1 CVE)

TuxCare rebuilt 2 @remix-run packages to address 1 CVE. Fixed in 1.19.3-tuxcare.4.

Record
CLSA-2026-1790461041
Updated
2026-11-02
OSVCLSA-2026-1792161539 No score

TuxCare security update for @remix-run/server-runtime (4 CVEs)

TuxCare rebuilt @remix-run/server-runtime to address 4 CVEs. Fixed in 2.17.0-tuxcare.1.

Record
CLSA-2026-1792161539
Updated
2026-11-02
OSVCLSA-2026-1792161542 No score

TuxCare security update for @remix-run/server-runtime (3 CVEs)

TuxCare rebuilt @remix-run/server-runtime to address 3 CVEs. Fixed in 1.19.3-tuxcare.4.

Record
CLSA-2026-1792161542
Updated
2026-11-02
OSVCLSA-2026-1792253395 No score

TuxCare security update for react-router-dom (1 CVE)

TuxCare rebuilt react-router-dom to address 1 CVE. Fixed in 7.5.1-tuxcare.5.

Record
CLSA-2026-1792253395
Updated
2026-11-02
OSVCLSA-2026-1792279963 No score

TuxCare security update for @remix-run/react (3 CVEs)

TuxCare rebuilt @remix-run/react to address 3 CVEs. Fixed in 2.17.0-tuxcare.1.

Record
CLSA-2026-1792279963
Updated
2026-11-02
OSVCLSA-2026-1792279967 No score

TuxCare security update for @remix-run/react (2 CVEs)

TuxCare rebuilt @remix-run/react to address 2 CVEs. Fixed in 1.19.3-tuxcare.4.

Record
CLSA-2026-1792279967
Updated
2026-11-02
OSVCLSA-2026-1792419111 No score

TuxCare security update for @react-router/architect (3 CVEs)

TuxCare rebuilt @react-router/architect to address 3 CVEs. Fixed in 7.5.1-tuxcare.5.

Record
CLSA-2026-1792419111
Updated
2026-11-02
OSVCLSA-2026-1792419188 No score

TuxCare security update for @react-router/cloudflare (3 CVEs)

TuxCare rebuilt @react-router/cloudflare to address 3 CVEs. Fixed in 7.5.1-tuxcare.5.

Record
CLSA-2026-1792419188
Updated
2026-11-02
OSVCLSA-2026-1792419267 No score

TuxCare security update for @react-router/express (3 CVEs)

TuxCare rebuilt @react-router/express to address 3 CVEs. Fixed in 7.5.1-tuxcare.5.

Record
CLSA-2026-1792419267
Updated
2026-11-02
OSVCLSA-2026-1792419623 No score

TuxCare security update for @react-router/node (1 CVE)

TuxCare rebuilt @react-router/node to address 1 CVE. Fixed in 7.5.1-tuxcare.5.

Record
CLSA-2026-1792419623
Updated
2026-11-02
OSVCLSA-2026-1792421941 No score

TuxCare security update for @react-router/remix-routes-option-adapter (3 CVEs)

TuxCare rebuilt @react-router/remix-routes-option-adapter to address 3 CVEs. Fixed in 7.5.1-tuxcare.5.

Record
CLSA-2026-1792421941
Updated
2026-11-02
OSVCLSA-2026-1792424730 No score

TuxCare security update for @react-router/dev (3 CVEs)

TuxCare rebuilt @react-router/dev to address 3 CVEs. Fixed in 7.5.1-tuxcare.5.

Record
CLSA-2026-1792424730
Updated
2026-11-02
OSVCLSA-2026-1792425405 No score

TuxCare security update for @react-router/fs-routes (3 CVEs)

TuxCare rebuilt @react-router/fs-routes to address 3 CVEs. Fixed in 7.5.1-tuxcare.5.

Record
CLSA-2026-1792425405
Updated
2026-11-02
OSVCLSA-2026-1792428107 No score

TuxCare security update for @react-router/serve (3 CVEs)

TuxCare rebuilt @react-router/serve to address 3 CVEs. Fixed in 7.5.1-tuxcare.5.

Record
CLSA-2026-1792428107
Updated
2026-11-02
OSVCLSA-2026-1792430030 No score

TuxCare security update for create-react-router (3 CVEs)

TuxCare rebuilt create-react-router to address 3 CVEs. Fixed in 7.5.1-tuxcare.5.

Record
CLSA-2026-1792430030
Updated
2026-11-02
OSVSUSE-SU-2026:4585-1 No score

Security update 5.2.1 for Multi-Linux Manager Client Tools

This update fixes the following issues:

golang-github-prometheus-prometheus was updated to version 3.13.2:

  • Security issues:

    • CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling (bsc#1266608)
    • CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling (bsc#1272102)
    • CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements (bsc#1275205)
    • CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS (bsc#1269966)
    • CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856)
    • CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects (bsc#1275206)
    • CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects (bsc#1275207)
    • CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage (bsc#1270711)
    • CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router (bsc#1267528)
    • CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538)
    • CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router (bsc#1267534)
    • CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274221)
    • Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency
    • Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit

  • Bug fixes and changes:

    • Fixed scrape manager failing to reload properly when SD configuration changes rapidly.
    • Prevent memory leak in remote-write path when the receiving endpoint is unavailable.
    • Native Histograms are no longer experimental. They are fully supported for production workloads.
    • Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces.
    • TSDB compaction speed optimized by improving the block merging algorithm.
    • Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead.
    • Added new metrics to monitor the health of the rule evaluation engine.
    • Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need adjustments to avoid redirects.
    • Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must adapt to the new longer token format.
    • Added 'group_limit' parameter to PromQL aggregations to restrict the number of results.
    • Incompatible: promtool relative paths in config files now resolve relative to the config directory itself, instead of the current working directory.
    • Support exporting TSDB blocks directly to cloud storage via the admin API.
    • Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed in favor of prometheus_wal_watcher_records_read_total.
    • Significant query performance boost for high-cardinality regex matchers.
    • Introduce a new UI interface for safely deleting specific time series data directly.
    • Added dynamic relabeling actions to extract substrings using regex capture groups.
    • Fixed UI displaying incorrect time ranges after a timezone change.
    • Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0

grafana was updated to version 12.4.10:

  • Security issues:

    • CVE-2026-17183: Fixed exposing data accessible through Grafana's configured datasource credentials (bsc#1275934)
    • CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269841)
    • CVE-2026-17033: Fixed stored cross-site scripting risks via malicious Alertmanager generator URLs (bsc#1276426)
    • CVE-2026-73501: Fixed fail-open authentication bypass in kin-openapi default handlers (bsc#1276973) *…
Record
SUSE-SU-2026:4585-1
Updated
2026-11-02
OSVSUSE-SU-2026:4606-1 No score

Security update for golang-github-prometheus-prometheus

This update for golang-github-prometheus-prometheus fixes the following issues:

golang-github-prometheus-prometheus was updated to version 3.13.2:

  • Security issues:

    • CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling (bsc#1266608)
    • CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling (bsc#1272102)
    • CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements (bsc#1275205)
    • CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS (bsc#1269966)
    • CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856)
    • CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects (bsc#1275206)
    • CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects (bsc#1275207)
    • CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage (bsc#1270711)
    • CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router (bsc#1267528)
    • CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538)
    • CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router (bsc#1267534)
    • CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274221)
    • Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency
    • Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit

  • Bug fixes and changes:

    • Fixed scrape manager failing to reload properly when SD configuration changes rapidly.
    • Prevent memory leak in remote-write path when the receiving endpoint is unavailable.
    • Native Histograms are no longer experimental. They are fully supported for production workloads.
    • Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces.
    • TSDB compaction speed optimized by improving the block merging algorithm.
    • Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead.
    • Added new metrics to monitor the health of the rule evaluation engine.
    • Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need adjustments to avoid redirects.
    • Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must adapt to the new longer token format.
    • Added 'group_limit' parameter to PromQL aggregations to restrict the number of results.
    • Incompatible: promtool relative paths in config files now resolve relative to the config directory itself, instead of the current working directory.
    • Support exporting TSDB blocks directly to cloud storage via the admin API.
    • Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed in favor of prometheus_wal_watcher_records_read_total.
    • Significant query performance boost for high-cardinality regex matchers.
    • Introduce a new UI interface for safely deleting specific time series data directly.
    • Added dynamic relabeling actions to extract substrings using regex capture groups.
    • Fixed UI displaying incorrect time ranges after a timezone change.
    • Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0
Record
SUSE-SU-2026:4606-1
Updated
2026-11-02

Affected products

Show 39 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
@react-router/node
npm
 7.0.0 to 7.9.3
7.9.4
@remix-run/node
npm
 through 2.17.1
2.17.2
@remix-run/deno
npm
 through 2.17.1
2.17.2
@remix-run/deno
TuxCare:npm
 2.17.0-tuxcare.0 up to 2.17.0-tuxcare.1, plus listed versions
2.17.0
2.17.0-tuxcare.1
@remix-run/node
TuxCare:npm
 2.17.0-tuxcare.0 up to 2.17.0-tuxcare.1, plus listed versions
2.17.0
2.17.0-tuxcare.1
react-router
TuxCare:npm
From an advisory covering 3 CVEs
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.5, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.27.5.1-tuxcare.37.5.1-tuxcare.4
7.5.1-tuxcare.5
react-router-dev
TuxCare:npm
From an advisory covering 3 CVEs
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.5, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.27.5.1-tuxcare.37.5.1-tuxcare.4
7.5.1-tuxcare.5
@remix-run/deno
TuxCare:npm
 1.19.3-tuxcare.0 up to 1.19.3-tuxcare.4, plus listed versions
1.19.31.19.3-tuxcare.11.19.3-tuxcare.21.19.3-tuxcare.3
1.19.3-tuxcare.4
@remix-run/node
TuxCare:npm
 1.19.3-tuxcare.0 up to 1.19.3-tuxcare.4, plus listed versions
1.19.31.19.3-tuxcare.11.19.3-tuxcare.21.19.3-tuxcare.3
1.19.3-tuxcare.4
@remix-run/server-runtime
TuxCare:npm
From an advisory covering 4 CVEs
 2.17.0-tuxcare.0 up to 2.17.0-tuxcare.1, plus listed versions
2.17.0
2.17.0-tuxcare.1
Show 26 moreShow less
Affected packages
PackageAffectedFixed
@remix-run/server-runtime
TuxCare:npm
From an advisory covering 3 CVEs
 1.19.3-tuxcare.0 up to 1.19.3-tuxcare.4, plus listed versions
1.19.31.19.3-tuxcare.11.19.3-tuxcare.21.19.3-tuxcare.3
1.19.3-tuxcare.4
react-router-dom
TuxCare:npm
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.5, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.4
7.5.1-tuxcare.5
@remix-run/react
TuxCare:npm
From an advisory covering 3 CVEs
 2.17.0-tuxcare.0 up to 2.17.0-tuxcare.1, plus listed versions
2.17.0
2.17.0-tuxcare.1
@remix-run/react
TuxCare:npm
From an advisory covering 2 CVEs
 1.19.3-tuxcare.0 up to 1.19.3-tuxcare.4, plus listed versions
1.19.31.19.3-tuxcare.11.19.3-tuxcare.21.19.3-tuxcare.3
1.19.3-tuxcare.4
@react-router/architect
TuxCare:npm
From an advisory covering 3 CVEs
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.5, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.4
7.5.1-tuxcare.5
@react-router/cloudflare
TuxCare:npm
From an advisory covering 3 CVEs
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.5, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.4
7.5.1-tuxcare.5
@react-router/express
TuxCare:npm
From an advisory covering 3 CVEs
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.5, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.4
7.5.1-tuxcare.5
@react-router/node
TuxCare:npm
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.5, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.4
7.5.1-tuxcare.5
@react-router/remix-routes-option-adapter
TuxCare:npm
From an advisory covering 3 CVEs
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.5, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.4
7.5.1-tuxcare.5
@react-router/dev
TuxCare:npm
From an advisory covering 3 CVEs
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.5, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.4
7.5.1-tuxcare.5
@react-router/fs-routes
TuxCare:npm
From an advisory covering 3 CVEs
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.5, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.4
7.5.1-tuxcare.5
@react-router/serve
TuxCare:npm
From an advisory covering 3 CVEs
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.5, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.4
7.5.1-tuxcare.5
create-react-router
TuxCare:npm
From an advisory covering 3 CVEs
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.5, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.4
7.5.1-tuxcare.5
@react-router/node
npm
 7.0.0 up to 7.9.4
7.9.4
@remix-run/node
npm
 before 2.17.2
2.17.2
@remix-run/deno
npm
 before 2.17.2
2.17.2
golang-github-prometheus-prometheus
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 58 CVEs
 before 3.13.2-150002.3.19.1
3.13.2-150002.3.19.1
grafana
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 58 CVEs
 before 12.4.10-150002.4.27.1
12.4.10-150002.4.27.1
mgr-push
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 58 CVEs
 before 5.2.5-150002.3.12.1
5.2.5-150002.3.12.1
spacecmd
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 58 CVEs
 before 5.2.10-150002.3.15.1
5.2.10-150002.3.15.1
spacewalk-client-tools
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 58 CVEs
 before 5.2.7-150002.3.12.1
5.2.7-150002.3.12.1
uyuni-tools
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 58 CVEs
 before 5.2.17-150002.3.20.1
5.2.17-150002.3.20.1
venv-salt-minion
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 58 CVEs
 before 3006.0-150002.5.22.1
3006.0-150002.5.22.1
uyuni-tools
SUSE:Multi Linux Manager Tools SLE-Micro-5
From an advisory covering 58 CVEs
 before 5.2.17-150002.3.20.1
5.2.17-150002.3.20.1
venv-salt-minion
SUSE:Multi Linux Manager Tools SLE-Micro-5
From an advisory covering 58 CVEs
 before 3006.0-150002.5.22.1
3006.0-150002.5.22.1
golang-github-prometheus-prometheus
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 11 CVEs
 before 3.13.2-150100.4.40.2
3.13.2-150100.4.40.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubFlowerWitch/CVE-2025-61686_docker2026-01-15
PoC in GitHubKai-One001/React-Router-CVE-2025-61686-2026-01-16
PoC in GitHubboroeurnprach/CVE-2025-61686-PoC2026-01-21

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-61686 is a critical vulnerability (CVSS 9.1) in @tanstack React-router, published January 8, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 17.3%, the 97th percentile. Fixed in @react-router/node 7.9.4.

References

Show 141 moreShow less
This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open