@apimatic/cli (>=2.0.0-beta.1, <=2.0.0), @cangjielang/aceharness (>=1.0.0-rc.11, <=1.0.0-rc.13-test.0) +27 more potentially affected by CVE-2026-102989 via @tanstack/react-start (>=1.166.18, <=1.168.50)

@tanstack/react-start NPM version =1.166.18, =2.0.0-beta.1, =1.0.0-rc.11, =2.0.0, =2.0.0, =0.1.1, =0.2.0, =0.1.77, =0.1.50, =0.1.43, =0.1.8, =0.5.0, =0.0.0, =0.0.2 - @kstackz/auth-toolkit 0.0.0 and more Source cves: CVE-2026-102989 Source advisory: SNYK:JS-TANSTACKREACTSTART-21201266...

@apimatic/cli (>=2.0.0-beta.1, <=2.0.0), @cangjielang/aceharness (>=1.0.0-rc.11, <=1.0.0-rc.13-test.0) +27 more potentially affected by CVE-2026-102989 via @tanstack/react-start (>=1.166.18, <=1.168.50)

@tanstack/react-start NPM version =1.166.18, =2.0.0-beta.1, =1.0.0-rc.11, =2.0.0, =2.0.0, =0.1.1, =0.2.0, =0.1.77, =0.1.50, =0.1.43, =0.1.8, =0.5.0, =0.0.0, =0.0.2 - @kstackz/auth-toolkit 0.0.0 and more Source cves: CVE-2026-102989 Source advisory: OSV:GHSA-QX66-FV34-FJM8...

EUVD-2026-98849

TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses...

@apimatic/cli (>=2.0.0-beta.1, <=2.0.0), @cangjielang/aceharness (>=1.0.0-rc.11, <=1.0.0-rc.13-test.0) +27 more potentially affected by CVE-2026-102989 via @tanstack/react-start (>=1.166.18, <=1.168.50)

@tanstack/react-start NPM version =1.166.18, =2.0.0-beta.1, =1.0.0-rc.11, =2.0.0, =2.0.0, =0.1.1, =0.2.0, =0.1.77, =0.1.50, =0.1.43, =0.1.8, =0.5.0, =0.0.0, =0.0.2 - @kstackz/auth-toolkit 0.0.0 and more Source cves: CVE-2026-102989 Source advisory: GHSA-QX66-FV34-FJM8...

CVE-2026-102989

TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an...

CVE-2026-102989

TanStack Router is vulnerable to an unauthenticated reflected XSS in its server-function responses. The root cause involves an attacker placing non-public fields in a server-function request payload, causing attacker-controlled middleware state to reach the error path. This allows a crafted URL t...

CVE-2026-102989

TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an...

@apimatic/cli (>=2.0.0-beta.1, <=2.0.0), @cangjielang/aceharness (>=1.0.0-rc.11, <=1.0.0-rc.13-test.0) +23 more potentially affected by CVE-2026-102989 via @tanstack/react-start (>=1.168.13, <=1.168.50)

@tanstack/react-start NPM version =1.168.13, =2.0.0-beta.1, =1.0.0-rc.11, =2.0.0, =2.0.0, =0.2.2, =0.1.77, =0.1.50, =0.1.43, =0.1.8, =0.5.0, =0.0.0, =0.0.2 - @kstackz/auth-toolkit 0.0.0 - @kstackz/ui-toolkit 0.0.0 and more Source cves: CVE-2026-102989 Source advisory: MEND:CVE-2026-102989...

CVE-2026-102989 TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an...

Malware in @tanstack/react-start

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @tanstack/react-start (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 006982dd9591684fdcea74c0b70c7600a22bfc969bac6b9fb64f728e7ab34d80 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-3468 Malicious code in @tanstack/react-start (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 006982dd9591684fdcea74c0b70c7600a22bfc969bac6b9fb64f728e7ab34d80 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @tanstack/react-start-server

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-3470 Malicious code in @tanstack/react-start-rsc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54678e0e02befdbc43f928e36fa9a25991d3eb222775849d4225eab0480904f1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @tanstack/react-start-rsc

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @tanstack/react-start-client

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-3469 Malicious code in @tanstack/react-start-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8358ce998650baf1a9cb6bb602109da81268c43855ad0b16f892687cc89f104d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@mastra/auth-workos (>=0.0.0-a-b-demo-20260521201120, <=1.5.2), @workos/authkit-sveltekit (>=0.0.1-alpha.0, <=0.2.0) +1 more potentially affected by CVE-2026-42565 via @workos/authkit-session (>=0.0.1-alpha.3, <=0.4.0)

@workos/authkit-session NPM version =0.0.1-alpha.3, =0.0.0-a-b-demo-20260521201120, =0.0.1-alpha.0, =0.1.0, =0.6.0 Source cves: CVE-2026-42565 Source advisory: SNYK:JS-WORKOSAUTHKITSESSION-16425670...

@clerk/chrome-extension (>=3.0.1-canary.v20260303211310, <=3.1.15-snapshot.v20260421194054), @clerk/expo (>=3.0.1-canary.v20260303211310, <=3.2.2-snapshot.v20260421194054) +7 more potentially affected by CVE-2026-42349 via @clerk/react (>=6.0.1-canary.v20260303211310, <=6.4.3-snapshot.v20260421194054)

@clerk/react NPM version =6.0.1-canary.v20260303211310, =3.0.1-canary.v20260303211310, =3.0.1-canary.v20260303211310, =7.0.1-canary.v20260303211310, =3.0.1-canary.v20260303211310, =1.0.1-canary.v20260303211310, =2.0.0-dev-cli-10, =2.0.0-dev-cli-10, =0.20.1-dev-push, =0.20.3-dev-push,...