TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
npm @tanstack/start-server-core · Upgrade to 1.169.39 or later · >= 1.143.12, < 1.169.39 · +3 more packages · CVE-2026-102989 · GHSA-qx66-fv34-fjm8 · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
npm @tanstack/start-server-core · Upgrade to 1.169.39 or later · >= 1.143.12, < 1.169.39 · +3 more packages · CVE-2026-102989 · GHSA-qx66-fv34-fjm8 · amended
npm @anthropic-ai/claude-code · Upgrade to 2.1.179 or later · < 2.1.179 · CVE-2026-86063 · GHSA-pq7j-f95f-qfcv · amended
npm @builder.io/qwik · Upgrade to 1.20.0 or later · < 1.20.0 · +1 more package · CVE-2026-84994 · GHSA-x586-xvc8-g7q6 · amended
Go github.com/getkin/kin-openapi · Upgrade to 0.149.0 or later · >= 0.136.0, < 0.149.0 · CVE-2026-100353 · GHSA-vrcc-3ch7-hppw · amended
Go github.com/getkin/kin-openapi · Upgrade to 0.149.0 or later · < 0.149.0 · CVE-2026-100354 · GHSA-g8cf-rcjf-c8cf · amended
Go github.com/getkin/kin-openapi · Upgrade to 0.148.0 or later · < 0.148.0 · CVE-2026-100352 · GHSA-rj39-cv6w-8wv7 · amended
Go github.com/getkin/kin-openapi · Upgrade to 0.147.0 or later · >= 0.144.0, < 0.147.0 · CVE-2026-100351 · GHSA-23vg-4cjm-66q5 · amended
Go github.com/dgraph-io/dgraph/v25 · Upgrade to 25.4.0 or later · <= 25.3.8 · CVE-2026-102748 · GHSA-qj98-gp63-54xj · amended
Go vitess.io/vitess · Upgrade to 0.24.2 or 0.23.5 by release line · < 0.23.5; >= 0.24.0, < 0.24.2 · CVE-2026-104252 · GHSA-v75v-6fpf-gvw8 · amended
crates.io mise · Upgrade to 2026.7.14 or later · <= 2026.7.13 · CVE-2026-103929 · GHSA-g74g-rg72-j2p3 · amended
npm @opennextjs/cloudflare · Upgrade to 1.20.2 or later · >= 0.3.0, < 1.20.2 · CVE-2026-100409 · GHSA-2vc4-c4r6-p6v6 · amended
Go github.com/getkin/kin-openapi · Upgrade to 0.143.0 or later · >= 0.136.0, < 0.143.0 · CVE-2026-97394 · GHSA-p6wj-qrr4-pgh5 · amended
Packagist leantime/leantime · Upgrade to 3.10.0 or later · < 3.10.0 · CVE-2026-85990 · GHSA-54mm-6729-r5wp · amended
Go github.com/dunglas/frankenphp · Upgrade to 1.12.5 or later · <= 1.12.4 · CVE-2026-82416 · GHSA-v3ph-cgqh-r8p5 · amended
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260703131214-23d1934099b0 (pre-release) or later · < 1.9.10-0.20260703131214-23d1934099b0 · CVE-2026-84360 · GHSA-vc32-4gwf-77xp · amended
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260703131214-23d1934099b0 (pre-release) or later · < 1.9.10-0.20260703131214-23d1934099b0 · CVE-2026-84316 · GHSA-cf23-7qxj-xmhr · amended
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260703131214-23d1934099b0 (pre-release) or later · < 1.9.10-0.20260703131214-23d1934099b0 · CVE-2026-84315 · GHSA-5v7c-xpfp-p65m · amended
RequireSecureSession on User Management EndpointGo github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260703131214-23d1934099b0 (pre-release) or later · < 1.9.10-0.20260703131214-23d1934099b0 · CVE-2026-84314 · GHSA-2gc7-j998-5xx6 · amended
nginx_config_add Bypasses Directive Validation — Authenticated RCEGo github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260703131214-23d1934099b0 (pre-release) or later · >= 1.9.10-0.20250506154222-1330888280a2, < 1.9.10-0.20260703131214-23d1934099b0 · CVE-2026-84318 · GHSA-9jww-cxg5-rj9m · amended
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260703131214-23d1934099b0 (pre-release) or later · < 1.9.10-0.20260703131214-23d1934099b0 · CVE-2026-84317 · GHSA-76pm-mq2q-9gcr · amended
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260703131214-23d1934099b0 (pre-release) or later · < 1.9.10-0.20260703131214-23d1934099b0 · CVE-2026-84319 · GHSA-5r62-gj48-897x · amended
Packagist react/http · Upgrade to 1.11.1 or later · >= 1.0.0, <= 1.11.0 · CVE-2026-104827 · GHSA-g4f2-2pf3-2pwj · amended
Maven com.github.junrar:junrar · Upgrade to 7.6.1 or later · <= 7.6.0 · CVE-2026-97370 · GHSA-h9h9-2rmf-rvhp · amended
Go github.com/bishopfox/sliver +1 · Upgrade all 2 to 1.7.6 or later · < 1.7.6 · CVE-2026-77622 · GHSA-663m-7x7m-g4fw · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.