Executive brief
TanStack Start is a full-stack web framework that handles server-side function calls from web applications. A type-confusion flaw in the deserialization layer allows an attacker to craft a malicious request to one server function that inadvertently triggers execution of a different server function. For correctly secured applications (those with proper authentication and input validation), the practical impact is limited, but organizations with legacy or improperly configured server functions risk unintended side effects and audit trail confusion.
Technical details
A type-confusion bug in seroval ≤ 1.5.2 (a deserialization library used by TanStack Start) allows a crafted JSON request body to one server function to invoke a different client-referenced server function as a side effect of payload deserialization. The vulnerability is rooted in how seroval handles adapter payloads that can be confused with internal node types. The attack vector is network-based and requires no authentication or user interaction, but exploitation is only meaningful if the target server function lacks both authentication/authorization middleware and input validation. Notably, server-only functions marked as `isClientReferenced: false` cannot be reached through this mechanism. Patches are available in @tanstack/start-server-core ≥ 1.167.30, which upgrades seroval to ≥ 1.5.3 and adds defense-in-depth serialization protection.
Affected products
- TanStack Start Server Core <1.167.30
Timeline
- 2026-05-14: disclosed: Advisory GHSA-9m65-766c-r333 published
- 2026-05-14: patched: Patch available in version 1.167.30 and equivalent dated releases