Six React Router and Remix vulnerabilities disclosed; upgrade urgently

The React Router team has disclosed six security vulnerabilities affecting React Router and Remix. Here's what Netlify customers need to know. Vulnerabilities Vulnerability: CVE-2025-61686 - Path traversal Remix versions: ≤2.17.1 React Router versions & modes: 7.0.0–7.9.3
All modes Vulnerability: CVE-2025-68470 - Open redirect Remix versions: - React Router versions & modes: 6.0.0–6.30.1, 7.0.0–7.9.5
All modes Vulnerability: CVE-2026-22030 - CSRF Remix versions: ≤2.17.2 React Router versions & modes: 7.0.0–7.11.0
Framework only Vulnerability: CVE-2025-59057 - Meta XSS Remix versions: 1.15.0–2.17.0 React Router versions & modes: 7.0.0–7.8.2
Framework only Vulnerability: CVE-2026-22029 - Redirect XSS Remix versions: ≤2.17.3 React Router versions & modes: 6.0.0–6.30.2, 7.0.0–7.11.0
Framework, Data Vulnerability: CVE-2026-21884 - ScrollRestoration XSS Remix versions: ≤2.17.2 React Router versions & modes: 7.0.0–7.11.0
Framework only Impact on Netlify CVE-2025-61686 (path traversal) This vulnerability affects @react-router/node, @remix-run/node, and @remix-run/deno. These packages are not used on Netlify, therefore Netlify projects are not affected. CVE-2025-68470 (open redirect) Apps with unsafe uses of React Router navigation APIs may be hijacked to redirect to arbitrary origins. Regardless of hosting provider, all apps constructing paths from untrusted user input may be vulnerable. CVE-2026-22030 (CSRF) Actions and experimental RSC Server Functions can be triggered by cross-origin form submissions, allowing an attacker to execute actions on behalf of authenticated users. Regardless of hosting provider, all apps may be vulnerable. CVE-2025-59057, CVE-2026-22029, and CVE-2026-21884 (XSS) These are cross-site scripting (XSS) vulnerabilities. For example, in CVE-2026-22029 actions and experimental RSC Server Functions performing a redirect to a path constructed from untrusted user input may be hijacked to execute arbitrary JavaScript in the browser. Regardless of hosting provider, all apps passing untrusted data into certain APIs may be vulnerable. (The Remix team has left this intentionally vague.) What should I do? If any of your projects are using any affected version listed above, we strongly recommend upgrading as soon as possible to patched releases:

• react-router 7.12.0 or later (for React Router 7.x)
• react-router 6.30.2 or later (for React Router 6.x)
• @remix-run/react 2.17.4 or later
• @remix-run/server-runtime 2.17.4 or later

Note that any publicly available deploy previews and branch deploys may remain vulnerable until they are automatically deleted. Consider deleting these deploys manually.