Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

remix-run/react-router

              main @ b4e4329
            

Fixes

CVEs

CRITICAL

Peak severity

42.9%

Coverage

Highlights

Auth Bypass: 3 prior fixes. Scrutinize any change in this area.

packages/remix-server-runtime/sessions.ts: most-fixed (2 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: The project relied on a vulnerable version of react-server-dom-parcel, exposing users to remote code execution under CVE-2025-55182. Upgrading dependencies securely isolated this surface.

Path Traversal: Unvalidated session IDs allowed attackers to write or read arbitrary files on the server using directory traversal. Forcing session IDs to adhere to a strict hexadecimal format mitigated the hazard.

Open Redirect: Failure to normalize mixed leading slashes (such as '\\' and '\/') meant malicious paths were treated as relative, enabling attackers to execute protocol-relative external redirects (CVE-2026-40181).