Vulnerabilities

TI-2026-71939 CVE-2026-102989 · GHSA-qx66-fv34-fjm8

Reflected cross-site scripting in TanStack Start server functions

MEDIUM 43

TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00544 Published 2026-10-13 Fixed in 1.168.60, 1.168.57 +2 CWE-79

TI-2026-54372 CVE-2026-78177 · GHSA-7f75-jp7p-2wcj

MEDIUM 44

A vulnerability was found in TanStack devtools-vite 0.7.0.

CVSS 4.0LOW 2.0 Local Low privileges No interaction EPSS 0.00904 Published 2026-08-24 No fix listed CWE-77

TI-2026-13131 CVE-2026-15607 · GHSA-m7mf-xqv5-gg8f

MEDIUM 57

A vulnerability was detected in tanstack db up to 0.6.8.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00437 Published 2026-07-13 No fix listed CWE-1321

TI-2026-33119 CVE-2026-45321 · GHSA-g7cv-rxg3-hmpx

CRITICAL 100KEV

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.03278 Published 2026-05-12 Fixed in 1.166.16, 1.161.13 +26 CWE-506

TI-2024-16179 CVE-2024-24558 · GHSA-997g-27x8-43rf

MEDIUM 42

TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00385 Published 2024-01-30 Fixed in 5.18.0 CWE-79