@tanstack/react-start vulnerabilities (npm)

2 vulnerabilities.

• @tanstack/react-start npm TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses CVE-2026-102989 Fix available 9.3 CriticalOctober 13, 2026
• @tanstack/react-start npm Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys CVE-2026-45321 In KEVPublic exploitFix available 9.6 CriticalMay 12, 2026