Skip to content
RequestGuard Vulnerabilities
Pricing
Vulnerability intelligence npm

@tanstack/start-server-core

Modern and scalable routing for React applications

npm latest 1.169.37 MIT

Evidence path

Version, exploitation, severity

RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.

1

Latest version

1.169.37

No matching published advisory returned

2

Known exploitation

No KEV match

Checked by exact CVE identifier

3

Highest advisory severity

Critical

3 active advisories

Check an exact version

The registry confirms the version, then OSV checks advisories for that exact value.

Published records

Advisories

3
GHSA-g7cv-rxg3-hmpx critical CISA KEV

Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

Affected range

SEMVER: introduced 1.167.33; fixed 1.167.37SEMVER: introduced 1.167.36; fixed 1.167.37

Fixed versions: 1.167.37

CVE-2026-45321 Source ↗Source ↗
GHSA-9m65-766c-r333 moderate

TanStack Start - Server Core: Inbound server-function request deserialization could invoke a sibling client-referenced server function

Affected range

SEMVER: introduced 0; fixed 1.167.30

Fixed versions: 1.167.30

Source ↗Source ↗