@tanstack vulnerabilities

Products

• start-server-core 3
• react-start 2
• solid-start 2
• vue-start 2
• @tanstack/form-core 1
• @tanstack/react-query-next-experimental 1
• @tanstack/router-vite-plugin 1
• arktype-adapter 1
• db 1
• devtools-vite 1
• eslint-plugin-router 1
• eslint-plugin-start 1
• history 1
• nitro-v2-vite-plugin 1
• outer-vite-plugin 1
• react-router 1
• react-router-devtools 1
• react-router-ssr-query 1
• react-start-client 1
• react-start-rsc 1
• react-start-server 1
• router 1
• router-cli 1
• router-core 1
• router-devtools 1
• router-devtools-core 1
• router-generator 1
• router-plugin 1
• router-ssr-query-core 1
• router-utils 1

Latest @tanstack CVEs

Newest publication first

1. CVE-2026-102989 TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

   Published 2026-10-13

   Critical·CVSS 9.3

   TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-sta...

2. CVE-2026-78177 TanStack devtools-vite Development Devtools Event Bus package-manager.ts installPackage os command injection

   Published 2026-08-24

   Low·CVSS 2.0

   A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results...

3. CVE-2026-15607 tanstack db Alias Path select.ts select prototype pollution

   Published 2026-07-13

   Medium·CVSS 5.3

   A vulnerability was detected in tanstack db up to 0.6.8. Affected by this vulnerability is the function select of the file src/query/compiler/select.ts of the component Alias Path Handler. The manipulation results in improperly controlled modification of object prototype attribut...

4. GHSA-9m65-766c-r333 TanStack Start - Server Core: Inbound server-function request deserialization could invoke a sibling client-referenced server function

   Published 2026-05-14

   Medium·CVSS 6.3

   Summary A type-confusion bug in seroval ≤ 1.5.2 (upstream advisory) allowed a crafted JSON body sent to one TanStack Start server function to trigger invocation of a different client-referenced server function as a side effect of deserializing the request payload. This is not an...

5. CVE-2026-45321 Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

   Published 2026-05-12

   Critical·CVSS 9.6 EPSS 3.3% CISA KEV added 2026-05-27 Ransomware Exploited in the wild

   On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publis...

6. CVE-2024-57068 @tanstack/form-core prototype pollution

   High·CVSS 7.5

   A prototype pollution in the lib.mutateMergeDeep function of @tanstack/form-core v0.35.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

7. CVE-2024-24558 react-query-streamed-hydration Cross-site Scripting vulnerability

   High·CVSS 8.2

   Impact The @tanstack/react-query-next-experimental NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this, an attacker would need to either inject malicious input or arrange to have malicious input be returned from an endpoint. This vulnerability arise...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.