Login Request a demo
ST
Product
start-server-core
by @tanstack · last CVE Oct 13, 2026
On CISA KEVExploited in the wildRansomware-linked
2
CVEs
1
On KEV
9.6
Max CVSS
1
New 30D
Vulnerabilities2In the news2Timeline
Severity mix
Critical 2High 0Medium 0Low 0
Severity
All severities2Critical2High0Medium0Low0
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add start-server-core to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-45321
RansomwareIn wildKEV
9.6
3%
May 12
Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
Affected: 1.167.33; 1.167.36
CVE-2026-102989
9.3
1%
Oct 13
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
Affected: >= 1.143.12, < 1.169.39
Showing 2