Impact
Applications that use createFileSessionStorage() with an unsigned cookie can be made to attempt reads or writes outside the configured session directory [S1]. Success depends on the filesystem permissions of the web-server process, and reads only populate the server-side session when the target file matches the expected session format; the file is not returned directly to the attacker [S1].
Root Cause
The affected file-session implementation accepts a session identifier that can resolve outside the intended storage directory when the cookie is unsigned [S1]. GitHub classifies the issue as CWE-22 path traversal and rates it 9.1 critical, with high integrity and availability impact but no direct confidentiality impact in the CVSS vector [S1].
Affected and Fixed Versions
The reviewed advisory lists @react-router/node versions 7.0.0 through 7.9.3 as affected and 7.9.4 as patched [S1]. It also lists @remix-run/node and @remix-run/deno through 2.17.1 as affected, with 2.17.2 patched [S1].
Concrete Fixes
Upgrade @react-router/node to 7.9.4 or later, or upgrade the affected Remix package to 2.17.2 or later [S1]. Configure file-backed sessions with a signed cookie, rotate exposed signing secrets when appropriate, regenerate dependency locks, and verify that the deployed application uses the fixed package [S1].
Why FixVibe will not add a dedicated check
FixVibe's existing repository dependency-vulnerability check correlates npm package versions with OSV and GitHub advisory data, so it can report the affected dependency without a separate CVE-specific module [S2]. The existing finding is dependency evidence only: it does not prove that the application calls createFileSessionStorage(), uses an unsigned cookie, is deployed with the reported package, or grants the process access to sensitive paths [S1].