CVE-2025-59057

🗓️ 10 Jan 2026 02:40:25Reported by GitHub_MType

XSS in React Router meta APIs Framework Mode during SSR; patched in Remix 2.17.1 and React Router 7.9.0.

Reporter	Title	Published	Views	Family All 34
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Engineering AI hub.	6 May 202608:24	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by vulnerabilities in js-yaml, minimatch, and react-router	17 Mar 202607:49	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for January 2026	22 Apr 202617:04	–	ibm
IBM Security Bulletins	Security Bulletin: Carbon Charts React Router Security Vulnerabilities	27 Apr 202607:14	–	ibm
IBM Security Bulletins	Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale Management GUI and/or BDA are now included.	2 Mar 202623:03	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	2 Mar 202616:48	–	ibm
IBM Security Bulletins	Security Bulletin: XSS Vulnerability in React Router meta()/Meta APIs During SSR, affects watsonx.data	10 Apr 202605:59	–	ibm
Circl	CVE-2025-59057	10 Jan 202603:23	–	circl
CNNVD	react-router 跨站脚本漏洞	10 Jan 202600:00	–	cnnvd
Cvelist	CVE-2025-59057 React Router has XSS Vulnerability	10 Jan 202602:40	–	cvelist

NVD

Vulners

Node

shopify react-routerRange7.0.0–7.8.2node.js

shopify remix-run/reactRange1.15.0–2.17.0node.js

[
  {
    "vendor": "remix-run",
    "product": "react-router",
    "versions": [
      {
        "version": "@remix-run/react >= 1.15.0, < 2.17.1",
        "status": "affected"
      },
      {
        "version": "react-router  >= 7.0.0, < 7.9.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/remix-run/react-router/security/advisories/GHSA-3cgp-3xvw-98x8

30 Jan 2026 18:19Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.17.6

EPSS0.00023

SSVC

CWE-79