@tanstack/start-server-core
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- npm
- Vulnerability status
- 3 advisory(ies) without a verdict
Advisories (4)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-9m65-766c-r333 TanStack Start - Server Core: Inbound server-function request deserialization could invoke a sibling client-referenced server function | < 1.167.30 | Undetermined |
| GHSA-g7cv-rxg3-hmpx Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys | 1.167.33 – < 1.167.37 ; 1.167.36 – < 1.167.37 | Undetermined |
| GHSA-qx66-fv34-fjm8 TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses | 1.143.12 – < 1.169.39 | Undetermined |
| MAL-2026-3490 Malicious code in @tanstack/start-server-core (npm) | 1.167.36, 1.167.33 | Not affected |
Sources
| Source | Licence |
|---|