npmPackage

@react-router/node

1 known vulnerability (1 critical), with the versions each affects and the releases that fix them.

Latest release: 8.5.1 (Oct 27, 2026): no advisory affects it
Newest unaffected release: 8.5.1 (Oct 27, 2026), the latest release
Advisories: 1 · 1 critical

Weekly downloads: 4.1M
Dependents: 25
Releases: 500+ since 7.2.0 (Feb 18, 2025)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2025-61686
Affects 7.2.0-pre.1 to 7.9.4-pre.0 (7.9.4 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 1

CVE-2025-61686Critical 9.1
React Router has Path Traversal in File Session Storage
Affected: from 7.0.0, fixed in 7.9.4.
Fixed in 7.9.4 (released Oct 8, 2025, 94 days before disclosure).
The latest release, 8.5.1, is not affected.
6.2% of @react-router/node downloads last week were affected versions (270.1K).