# Risk map — remix-run/react-router

> Canonical page: https://codevetter.com/unpack/react-router/risk-map

# Risk map — remix-run/react-router

Scanned commit a6090382ed467b5a2d46c8de1a13b331f14959f8 (2026-09-30). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The observations below identify security and correctness boundaries, not confirmed vulnerabilities. Cookie signing, filesystem identifiers, client/server module separation, request origins, and proxy-derived URLs deserve focused review when changed. The shared navigation engine has a large behavioral blast radius because cancellation, hydration, actions, and loading meet there. Runtime failures, deployment policy, and uninspected tests remain unverified.
- Cookie signing is optional: createCookie defaults secrets to an empty array, while session storage warns about unsigned cookies rather than rejecting them. — [packages/react-router/lib/server-runtime/cookies.ts#L81-99](https://github.com/remix-run/react-router/blob/a6090382ed467b5a2d46c8de1a13b331f14959f8/packages/react-router/lib/server-runtime/cookies.ts#L81-L99) [packages/react-router/lib/server-runtime/sessions.ts#L328-335](https://github.com/remix-run/react-router/blob/a6090382ed467b5a2d46c8de1a13b331f14959f8/packages/react-router/lib/server-runtime/sessions.ts#L328-L335)
- Cookie session content is JSON/base64 encoded and optionally HMAC signed, so signing supplies integrity rather than encryption. — [packages/react-router/lib/server-runtime/cookies.ts#L169-179](https://github.com/remix-run/react-router/blob/a6090382ed467b5a2d46c8de1a13b331f14959f8/packages/react-router/lib/server-runtime/cookies.ts#L169-L179) [packages/react-router/lib/server-runtime/cookies.ts#L200-206](https://github.com/remix-run/react-router/blob/a6090382ed467b5a2d46c8de1a13b331f14959f8/packages/react-router/lib/server-runtime/cookies.ts#L200-L206) [packages/react-router/lib/server-runtime/crypto.ts#L3-12](https://github.com/remix-run/react-router/blob/a6090382ed467b5a2d46c8de1a13b331f14959f8/packages/react-router/lib/server-runtime/crypto.ts#L3-L12)
- The cookie defaults shown set path and sameSite=lax; this default construction does not set secure or httpOnly. — [packages/react-router/lib/server-runtime/cookies.ts#L81-89](https://github.com/remix-run/react-router/blob/a6090382ed467b5a2d46c8de1a13b331f14959f8/packages/react-router/lib/server-runtime/cookies.ts#L81-L89)
- File storage performs filesystem IO beneath a caller-selected dir, and getFile rejects identifiers outside the 16-character hexadecimal format before path construction. — [packages/react-router-node/sessions/fileStorage.ts#L31-54](https://github.com/remix-run/react-router/blob/a6090382ed467b5a2d46c8de1a13b331f14959f8/packages/react-router-node/sessions/fileStorage.ts#L31-L54) [packages/react-router-node/sessions/fileStorage.ts#L115-124](https://github.com/remix-run/react-router/blob/a6090382ed467b5a2d46c8de1a13b331f14959f8/packages/react-router-node/sessions/fileStorage.ts#L115-L124)
- Hypothesis: concurrent file-session updates merit additional verification because updateData directly overwrites JSON without locking or atomic replacement in the inspected implementation. (inferred) — [packages/react-router-node/sessions/fileStorage.ts#L87-94](https://github.com/remix-run/react-router/blob/a6090382ed467b5a2d46c8de1a13b331f14959f8/packages/react-router-node/sessions/fileStorage.ts#L87-L94)
- Document mutation requests invoke throwIfPotentialCSRFAttack with configured allowedActionOrigins and return 400 when that check throws. — [packages/react-router/lib/server-runtime/server.ts#L456-468](https://github.com/remix-run/react-router/blob/a6090382ed467b5a2d46c8de1a13b331f14959f8/packages/react-router/lib/server-runtime/server.ts#L456-L468)
- Express request URL construction depends on trust proxy, forwarded host/host ports, and req.protocol; hostname delimiters are stripped before URL creation. — [packages/react-router-express/server.ts#L92-109](https://github.com/remix-run/react-router/blob/a6090382ed467b5a2d46c8de1a13b331f14959f8/packages/react-router-express/server.ts#L92-L109)
- Client/server separation depends on both removal of server-only route exports and the dot-server resolve hook rejecting surviving client references. — [packages/react-router-dev/vite/plugin.ts#L2140-2160](https://github.com/remix-run/react-router/blob/a6090382ed467b5a2d46c8de1a13b331f14959f8/packages/react-router-dev/vite/plugin.ts#L2140-L2160) [packages/react-router-dev/vite/plugin.ts#L2174-2192](https://github.com/remix-run/react-router/blob/a6090382ed467b5a2d46c8de1a13b331f14959f8/packages/react-router-dev/vite/plugin.ts#L2174-L2192) [packages/react-router-dev/vite/plugin.ts#L2273-2284](https://github.com/remix-run/react-router/blob/a6090382ed467b5a2d46c8de1a13b331f14959f8/packages/react-router-dev/vite/plugin.ts#L2273-L2284)
- Application scaffolding can launch package-manager installation through child_process.spawn with a supplied working directory. — [packages/create-react-router/index.ts#L613-654](https://github.com/remix-run/react-router/blob/a6090382ed467b5a2d46c8de1a13b331f14959f8/packages/create-react-router/index.ts#L613-L654)
- The shared navigation path aborts previous work and later commits combined action, loader, error, and fetcher state, making edits here relevant across several observable behaviors. — [packages/react-router/lib/router/router.ts#L1944-1951](https://github.com/remix-run/react-router/blob/a6090382ed467b5a2d46c8de1a13b331f14959f8/packages/react-router/lib/router/router.ts#L1944-L1951) [packages/react-router/lib/router/router.ts#L2144-2155](https://github.com/remix-run/react-router/blob/a6090382ed467b5a2d46c8de1a13b331f14959f8/packages/react-router/lib/router/router.ts#L2144-L2155)
- Typegen removes generated directories before writing, and root clean scripts invoke git clean; these commands have filesystem side effects and were not run. — [packages/react-router-dev/typegen/index.ts#L33-39](https://github.com/remix-run/react-router/blob/a6090382ed467b5a2d46c8de1a13b331f14959f8/packages/react-router-dev/typegen/index.ts#L33-L39) [package.json#L14-16](https://github.com/remix-run/react-router/blob/a6090382ed467b5a2d46c8de1a13b331f14959f8/package.json#L14-L16)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)