Skip to content
OpenAdvisories

Product · TanStack

solid-start

2 known vulnerabilities.

All Critical High Medium Low Exploited only

2 results · Feed

  • Critical 9.3
    CVE-2026-102989

    TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

    TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 …

    TanStack react-start start-server-core solid-start npm
  • Critical 9.6
    CVE-2026-45321 Exploited · Ransomware

    Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

    On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/r…

    TanStack start-server-core solid-start vue-start npm
    KEV May 27, 2026