{"schema_version":1,"title":"@tanstack/start-server-core (npm) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 3 vulnerabilities in @tanstack/start-server-core (npm): 0 in the last 7 days and 1 in the last 90 days, 2 of them critical and 1 exploited in the wild. The most recent, CVE-2026-102989, was published on 13 October 2026. 1 vulnerability in the last four weeks, up from none in the four before. 1 critical against 0.","url":"https://junglewise.ai/threats/technologies/tanstack-start-server-core","json_url":"https://junglewise.ai/threats/technologies/tanstack-start-server-core.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/tanstack-start-server-core","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":0,"all_time":3,"critical":2,"exploited":1,"last_7_days":0,"last_30_days":0,"last_90_days":1,"last_365_days":3},"latest":[{"cve":"CVE-2026-102989","cvss":9.3,"epss":0.0052,"slug":"cve-2026-102989-tanstack-router-unauthenticated-reflected-xss-in-tanstack-start","title":"TanStack Start reflected XSS in server-function responses","severity":"critical","exploited":false,"published_at":"2026-10-13T17:17:14.797+00:00","url":"https://junglewise.ai/threats/cve-2026-102989-tanstack-router-unauthenticated-reflected-xss-in-tanstack-start"},{"cvss":4,"slug":"tanstack-start-server-core-type-confusion-in-request-deserialization-53e6cf74","title":"TanStack Start Server Core type confusion in request deserialization","severity":"medium","exploited":false,"published_at":"2026-05-14T16:37:10+00:00","url":"https://junglewise.ai/threats/tanstack-start-server-core-type-confusion-in-request-deserialization-53e6cf74"},{"cve":"CVE-2026-45321","cvss":9.6,"epss":0.0105,"slug":"cve-2026-45321-tanstack-npm-packages-supply-chain-compromise-via-github-actions","title":"TanStack npm packages supply chain compromise via GitHub Actions OIDC hijacking","severity":"critical","exploited":true,"published_at":"2026-05-12T01:16:46.82+00:00","url":"https://junglewise.ai/threats/cve-2026-45321-tanstack-npm-packages-supply-chain-compromise-via-github-actions"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":1,"exploited":0,"vulnerabilities":1},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"openclaw (npm)","slug":"npm-openclaw","vulnerabilities":214,"url":"https://junglewise.ai/threats/technologies/npm-openclaw"},{"name":"flowise (npm)","slug":"flowise","vulnerabilities":133,"url":"https://junglewise.ai/threats/technologies/flowise"},{"name":"parse-server (npm)","slug":"parse-server","vulnerabilities":117,"url":"https://junglewise.ai/threats/technologies/parse-server"},{"name":"vm2 (npm)","slug":"vm2","vulnerabilities":111,"url":"https://junglewise.ai/threats/technologies/vm2"},{"name":"electron (npm)","slug":"electron","vulnerabilities":77,"url":"https://junglewise.ai/threats/technologies/electron"},{"name":"ghost (npm)","slug":"ghost","vulnerabilities":74,"url":"https://junglewise.ai/threats/technologies/ghost"},{"name":"n8n (npm)","slug":"npm-n8n","vulnerabilities":64,"url":"https://junglewise.ai/threats/technologies/npm-n8n"},{"name":"hono (npm)","slug":"hono","vulnerabilities":62,"url":"https://junglewise.ai/threats/technologies/hono"},{"name":"directus (npm)","slug":"directus","vulnerabilities":61,"url":"https://junglewise.ai/threats/technologies/directus"},{"name":"nocodb (npm)","slug":"nocodb","vulnerabilities":54,"url":"https://junglewise.ai/threats/technologies/nocodb"},{"name":"undici (npm)","slug":"undici","vulnerabilities":53,"url":"https://junglewise.ai/threats/technologies/undici"},{"name":"@budibase/server (npm)","slug":"budibase-server","vulnerabilities":42,"url":"https://junglewise.ai/threats/technologies/budibase-server"}],"technology":{"hub":true,"name":"@tanstack/start-server-core (npm)","slug":"tanstack-start-server-core","vendor":{"hub":true,"name":"npm","slug":"npm","url":"https://junglewise.ai/threats/vendors/npm"},"aliases":[],"homepage":"https://tanstack.com/start","repo_url":"https://github.com/TanStack/start","description":"@tanstack/start-server-core is a server-side framework library for building full-stack web applications with TanStack Start.","url":"https://junglewise.ai/threats/technologies/tanstack-start-server-core"},"most_severe":[{"cve":"CVE-2026-45321","cvss":9.6,"epss":0.0105,"slug":"cve-2026-45321-tanstack-npm-packages-supply-chain-compromise-via-github-actions","title":"TanStack npm packages supply chain compromise via GitHub Actions OIDC hijacking","severity":"critical","exploited":true,"published_at":"2026-05-12T01:16:46.82+00:00","url":"https://junglewise.ai/threats/cve-2026-45321-tanstack-npm-packages-supply-chain-compromise-via-github-actions"},{"cve":"CVE-2026-102989","cvss":9.3,"epss":0.0052,"slug":"cve-2026-102989-tanstack-router-unauthenticated-reflected-xss-in-tanstack-start","title":"TanStack Start reflected XSS in server-function responses","severity":"critical","exploited":false,"published_at":"2026-10-13T17:17:14.797+00:00","url":"https://junglewise.ai/threats/cve-2026-102989-tanstack-router-unauthenticated-reflected-xss-in-tanstack-start"},{"cvss":4,"slug":"tanstack-start-server-core-type-confusion-in-request-deserialization-53e6cf74","title":"TanStack Start Server Core type confusion in request deserialization","severity":"medium","exploited":false,"published_at":"2026-05-14T16:37:10+00:00","url":"https://junglewise.ai/threats/tanstack-start-server-core-type-confusion-in-request-deserialization-53e6cf74"}],"generated_at":"2026-11-13T03:07:00.155039+00:00"}