@tanstack react-start vulnerabilities

2 published CVEs name @tanstack react-start among the affected products; CISA lists 1 of them as exploited in the wild.

All 2 in the list Atom feed of new CVEs

Published CVEs: 2
Last 12 months: 2
Critical: 2
Known exploited: 1

Critical 2High 0Medium 0Low 0Not scored 0

Known exploitedNewest addition to KEV first

CVE-2026-45321
Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
@tanstack · arktype-adapter
ExploitedCritical9.6

Newest CVEs

CVE-2026-102989
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
TanStack · router
Critical9.3
CVE-2026-45321
Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
@tanstack · arktype-adapter
ExploitedCritical9.6

Most common weaknesses