Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that visitor and make requests with their authority. Cause The server-function transport can pass request payload fields into internal middleware state instead of limiting them to public input fields. A malformed payload can leave an attacker-controlled result in the error path. Response handling can then treat a response-shaped object as an HTTP response. Affected versions Published versions of @tanstack/start-server-core, @tanstack/react-start, @tanstack/solid-start, and @tanstack/vue-start from 1.143.12 up to, but not including, their respective patched versions are affected. The patched versions are @tanstack/start-server-core@1.169.39, @tanstack/react-start@1.168.60,…
Recommended action: Upgrade to 1.169.39 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A type-confusion bug in seroval ≤ 1.5.2 (upstream advisory) allowed a crafted JSON body sent to one TanStack Start server function to trigger invocation of a different client-referenced server function as a side effect of deserializing the request payload. This is not an authentication bypass and not remote code execution. The mechanism only invokes server functions that the same client could already reach directly via /serverFn/<id, and the target function's full middleware chain — including any user-supplied authentication, authorization, and inputValidator — runs as it would on a direct call. Impact To be exploitable in any meaningful sense, an application would need to expose a client-referenced server function that: - [ ] Performs a privileged side effect, and - [ ] Has no authentication/authorization middleware, and - [ ] Has no input validation A function meeting all three is already directly callable by any unauthenticated client at its own endpoint, so the practical…
Recommended action: Upgrade to 1.167.30 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/ packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pullrequesttarget "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart. Impact A user installing any affected version executes a payload (~2.3 MB obfuscated routerinit.js) at install time that: - Harvests credentials from common locations: - AWS instance metadata (IMDS) and Secrets Manager - GCP metadata service - Kubernetes…
Recommended action: Upgrade to 1.167.37 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.