Skip to content
@tanstack vulnerabilities
Newest
-
@tanstack react-start, solid-start, start-server-core +2 more +4 more
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
CVE-2026-102989
Fix available
9.3 Critical
-
@tanstack react-router
React Router: Unauthenticated Denial of Service via Inefficient Route Matching
CVE-2026-55685
Fix available
8.7 High
-
@tanstack react-router
React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)
CVE-2026-53669
Fix available
5.1 Medium
-
@tanstack react-router
React Router: Open redirect can lead to XSS
CVE-2026-53668
Fix available
6.9 Medium
-
@tanstack react-router
React Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667)
CVE-2026-53667
Fix available
6.9 Medium
-
@tanstack react-router
React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
CVE-2026-53666
Fix available
6.1 Medium
-
@remix-run server-runtime, @tanstack react-router +1 more
React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass
CVE-2026-53663
Fix available
3.1 Low
-
@tanstack react-router, remix-run @remix-run/server-runtime, shopify remix-run\/server-runtime +2 more
React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint
CVE-2026-42342
Fix available
7.5 High
-
@tanstack react-router
React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE
CVE-2026-42211
Fix available
8.1 High
-
@tanstack react-router, remix-run @remix-run/router +1 more
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
CVE-2026-40181
Fix available
6.6 Medium
-
@tanstack react-router, remix-run turbo-stream, turbo-stream turbo stream +2 more
React Router vulnerable to Denial of Service via reflected user input in single-fetch
CVE-2026-34077
Fix available
7.5 High
-
@tanstack react-router
React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets
CVE-2026-33245
Fix available
8.0 High
-
@tanstack react-router
React Router has stored XSS via unescaped Location header in prerendered redirect HTML
CVE-2026-33244
Fix available
5.4 Medium
-
tanstack, @tanstack arktype-adapter, eslint-plugin-router +211 more +213 more
Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
CVE-2026-45321
In KEVPublic exploitFix available
9.6 Critical
-
@clerk backend, nextjs, shared +31 more +33 more
Clerk: Authorization bypass when combining organization, billing, or reverification checks
CVE-2026-42349
Fix available
7.6 High
-
@tanstack react-router, shopify remix-run\/react +1 more
React Router has CSRF issue in Action/Server Action Request Processing
CVE-2026-22030
Fix available
6.5 Medium
-
@tanstack react-router, remix-run @remix-run/router, red hat cryostat 4 +74 more +76 more
React Router vulnerable to XSS via Open Redirects
CVE-2026-22029
Fix available
8.0 High
-
@tanstack react-router, red hat ansible automation platform 2.6, ansible automation platform 2.6 for rhel 9 +6 more +8 more
React Router SSR XSS in ScrollRestoration
CVE-2026-21884
Fix available
8.2 High
-
@tanstack react-router
React Router has unexpected external redirect via untrusted paths
CVE-2025-68470
Fix available
6.5 Medium
-
@tanstack react-router, red hat cryostat 4, gatekeeper 3 +47 more +49 more
React Router has Path Traversal in File Session Storage
CVE-2025-61686
Public exploitFix available
EPSS 17.3%
9.1 Critical
-
@tanstack react-router, red hat ansible automation platform 2.6, ansible automation platform 2.6 for rhel 9 +6 more +8 more
React Router has XSS Vulnerability
CVE-2025-59057
Public exploitFix available
7.6 High
-
@tanstack react-router
React Router allows pre-render data spoofing on React-Router framework mode
CVE-2025-43865
Public exploitFix available
8.2 High
-
@tanstack react-router
React Router allows a DoS via cache poisoning by forcing SPA mode
CVE-2025-43864
Public exploitFix available
EPSS 20.5%
7.5 High
-
@tanstack react-router
Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers
CVE-2025-31137
Public exploitFix available
7.5 High