react-start vulnerabilities

2 known vulnerabilities in react-start from TanStack. 2 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.3 Critical severity

  router: Improper Neutralization of Input During Web Page Generation

  CVE-2026-102989Oct 13, 2026TanStack

  TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 f

• 9.6 Critical severity

  TanStack Unspecified Exploited

  CVE-2026-45321May 12, 2026TanStackEPSS 3.28%

  On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/ro