Skip to content
OpenAdvisories

Package · npm

@tanstack/start-server-core

3 known vulnerabilities.

Malicious versions reported for this package

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Critical 9.3
    CVE-2026-102989

    TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

    TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 …

    TanStack react-start start-server-core solid-start npm
  • Medium —
    GHSA-9m65-766c-r333

    TanStack Start - Server Core: Inbound server-function request deserialization could invoke a sibling client-referenced server function

    ### Summary A type-confusion bug in seroval ≤ 1.5.2 ([upstream advisory](https://github.com/lxsmnsyc/seroval/security/advisories)) allowed a crafted JSON body sent to one TanStack Start server function to trigger invocation of a different client-referenced se…

    @tanstack/start-server-core npm
  • Critical 9.6
    CVE-2026-45321 Exploited · Ransomware Public exploit

    Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

    On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/r…

    TanStack start-server-core solid-start vue-start npm
    KEV May 27, 2026