3vulnerabilities
- Critical2 (66.7%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate1 (33.3%)
- Low0 (0.0%)
tanstack-start-server-core
Ecosystem: npm
Downloads:
- 2CriticalAffects 3 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 1ModerateAffects 1 version
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 1
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
- 2 vulnerabilities
- Critical: 1
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (3)
Known vulnerabilities affecting tanstack-start-server-core, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-qx66-fv34-fjm8 | Critical | TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses## Impact An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that visitor and make requests with their authority. ## Cause The server-function transport can pass request payload fields into internal middleware state instead of limiting them to public input fields. A malformed payload can leave an attacker-controlled result in the error path. Response handling ca |
| GitHub (opens in a new tab) | |
| GHSA-9m65-766c-r333 | Moderate | TanStack Start - Server Core: Inbound server-function request deserialization could invoke a sibling client-referenced server function### Summary A type-confusion bug in seroval ≤ 1.5.2 ([upstream advisory](https://github.com/lxsmnsyc/seroval/security/advisories)) allowed a crafted JSON body sent to one TanStack Start server function to trigger invocation of a different client-referenced server function as a side effect of deserializing the request payload. This is not an authentication bypass and not remote code execution. The mechanism only invokes server functions that the same client could already reach directly via /_serverFn/<id>, and the target function's full middleware chain — including any user-supplied authentica |
| GitHub (opens in a new tab) | |
| GHSA-g7cv-rxg3-hmpx | Critical | Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys## Summary On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to pu |
| GitHub (opens in a new tab) |
- GHSA-qx66-fv34-fjm8CriticalTanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
>= 1.143.12, < 1.169.39
## Impact An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that visitor and make requests with their authority. ## Cause The server-function transport can pass request payload fields into internal middleware state instead of limiting them to public input fields. A malformed payload can leave an attacker-controlled result in the error path. Response handling ca
CVE: CVE-2026-102989
- GHSA-9m65-766c-r333ModerateTanStack Start - Server Core: Inbound server-function request deserialization could invoke a sibling client-referenced server function
< 1.167.30
### Summary A type-confusion bug in seroval ≤ 1.5.2 ([upstream advisory](https://github.com/lxsmnsyc/seroval/security/advisories)) allowed a crafted JSON body sent to one TanStack Start server function to trigger invocation of a different client-referenced server function as a side effect of deserializing the request payload. This is not an authentication bypass and not remote code execution. The mechanism only invokes server functions that the same client could already reach directly via /_serverFn/<id>, and the target function's full middleware chain — including any user-supplied authentica
- GHSA-g7cv-rxg3-hmpxCriticalMalware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
>= 1.167.33, < 1.167.37>= 1.167.36, < 1.167.37
## Summary On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to pu
CVE: CVE-2026-45321