@tanstack react-start vulnerabilities

Latest @tanstack react-start CVEs

Newest publication first

1. CVE-2026-102989 TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

   Published 2026-10-13

   Critical·CVSS 9.3

   TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-sta...

2. CVE-2026-45321 Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

   Published 2026-05-12

   Critical·CVSS 9.6 EPSS 3.3% CISA KEV added 2026-05-27 Ransomware Exploited in the wild

   On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publis...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.