@apimatic/cli (>=2.0.0-beta.1, <=2.0.0-beta.6), @bgub/fig-tanstack-start (>=0.1.0-alpha.1, <=1.0.0) +44 more potentially affected by CVE-2026-102989 via @tanstack/start-server-core (>=1.143.12, <=1.169.38)

@tanstack/start-server-core NPM version =1.143.12, =2.0.0-beta.1, =0.1.0-alpha.1, =1.0.0-rc.11, =2.0.0, =2.0.0, =0.1.1, =1.168.32-depup.0, =0.1.31-depup.0, =1.167.23-depup.0, =0.2.0, =0.1.77, =0.1.50, =0.1.43, =0.1.8, =0.2.0 and more Source cves: CVE-2026-102989 Source advisory: GHSA-QX66-FV34-FJ...

@apimatic/cli (>=2.0.0-beta.1, <=2.0.0-beta.6), @bgub/fig-tanstack-start (>=0.1.0-alpha.1, <=1.0.0) +44 more potentially affected by CVE-2026-102989 via @tanstack/start-server-core (>=1.143.12, <=1.169.38)

@tanstack/start-server-core NPM version =1.143.12, =2.0.0-beta.1, =0.1.0-alpha.1, =1.0.0-rc.11, =2.0.0, =2.0.0, =0.1.1, =1.168.32-depup.0, =0.1.31-depup.0, =1.167.23-depup.0, =0.2.0, =0.1.77, =0.1.50, =0.1.43, =0.1.8, =0.2.0 and more Source cves: CVE-2026-102989 Source advisory:...

EUVD-2026-98849

TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses...

@apimatic/cli (>=2.0.0-beta.1, <=2.0.0-beta.6), @bgub/fig-tanstack-start (>=0.1.0-alpha.1, <=1.0.0) +44 more potentially affected by CVE-2026-102989 via @tanstack/start-server-core (>=1.143.12, <=1.169.38)

@tanstack/start-server-core NPM version =1.143.12, =2.0.0-beta.1, =0.1.0-alpha.1, =1.0.0-rc.11, =2.0.0, =2.0.0, =0.1.1, =1.168.32-depup.0, =0.1.31-depup.0, =1.167.23-depup.0, =0.2.0, =0.1.77, =0.1.50, =0.1.43, =0.1.8, =0.2.0 and more Source cves: CVE-2026-102989 Source advisory:...

CVE-2026-102989

TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an...

CVE-2026-102989

TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an...

CVE-2026-102989

TanStack Router is vulnerable to an unauthenticated reflected XSS in its server-function responses. The root cause involves an attacker placing non-public fields in a server-function request payload, causing attacker-controlled middleware state to reach the error path. This allows a crafted URL t...

@apimatic/cli (>=2.0.0-beta.1, <=2.0.0-beta.6), @bgub/fig-tanstack-start (>=0.1.0-alpha.1, <=1.0.0) +37 more potentially affected by CVE-2026-102989 via @tanstack/start-server-core (>=1.169.0, <=1.169.38)

@tanstack/start-server-core NPM version =1.169.0, =2.0.0-beta.1, =0.1.0-alpha.1, =1.0.0-rc.11, =2.0.0, =2.0.0, =1.168.32-depup.0, =0.1.31-depup.0, =1.167.23-depup.0, =0.2.2, =0.1.77, =0.1.50, =0.1.43, =0.1.8, =0.5.0, =0.11.0 and more Source cves: CVE-2026-102989 Source advisory: MEND:CVE-2026-102...

CVE-2026-102989 TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an...

@ardeora/start-devtools (>=1.0.0, <=1.0.1), @carvajalconsultants/headstart (>=1.0.0, <=1.0.2) +32 more potentially affected by unknown CVE via @tanstack/start-server-core (>=1.121.0-alpha.28, <=1.167.29)

@tanstack/start-server-core NPM version =1.121.0-alpha.28, =1.0.0, =1.0.0, =0.0.14, =1.0.0, =0.3.0, =0.3.0, =1.20.3-alpha.1, =1.111.10, =1.121.23, =0.0.1, =1.121.0-alpha.28, =1.20.3-alpha.1, =1.114.29, =1.121.23, =1.131.50 and more Source cves: unknown CVE Source advisory:...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' through an upstream type-confusion bug in seroval package. An attacker can trigger unintended execution of a different client-referenced server function by sending a specially...

@ardeora/start-devtools (>=1.0.0, <=1.0.1), @carvajalconsultants/headstart (>=1.0.0, <=1.0.2) +32 more potentially affected by unknown CVE via @tanstack/start-server-core (>=1.121.0-alpha.28, <=1.167.29)

@tanstack/start-server-core NPM version =1.121.0-alpha.28, =1.0.0, =1.0.0, =0.0.14, =1.0.0, =0.3.0, =0.3.0, =1.20.3-alpha.1, =1.111.10, =1.121.23, =0.0.1, =1.121.0-alpha.28, =1.20.3-alpha.1, =1.114.29, =1.121.23, =1.131.50 and more Source cves: unknown CVE Source advisory: GHSA-9M65-766C-R333...

@ardeora/start-devtools (>=1.0.0, <=1.0.1), @carvajalconsultants/headstart (>=1.0.0, <=1.0.2) +32 more potentially affected by unknown CVE via @tanstack/start-server-core (>=1.121.0-alpha.28, <=1.167.29)

@tanstack/start-server-core NPM version =1.121.0-alpha.28, =1.0.0, =1.0.0, =0.0.14, =1.0.0, =0.3.0, =0.3.0, =1.20.3-alpha.1, =1.111.10, =1.121.23, =0.0.1, =1.121.0-alpha.28, =1.20.3-alpha.1, =1.114.29, =1.121.23, =1.131.50 and more Source cves: unknown CVE Source advisory: OSV:GHSA-9M65-766C-R333...

Malware in @tanstack/start-server-core

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @tanstack/start-server-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7db0631bb410a51551790c0b55b574d53aea5d7a677439e6f3cf877503317658 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-3490 Malicious code in @tanstack/start-server-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7db0631bb410a51551790c0b55b574d53aea5d7a677439e6f3cf877503317658 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...