@tanstack/react-start

Security advisories

Grouped by the version that fixes them, so one upgrade reads as one step.

• No fixed version published yet · 1 advisory

  • Malicious code in @tanstack/react-start (npm)MAL-2026-3468

• Fixed in 1.167.72 · 1 advisory

  • CRITICALMalware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysGHSA-g7cv-rxg3-hmpx

Every stable release, newest first. Notes are quoted as the maintainers published them.

1. 1.169.2

   14 October 2026
   Updated dependencies:

   Patch Changes

   • Updated dependencies:

     • @tanstack/start-server-core@1.169.43

     • @tanstack/start-plugin-core@1.171.53

     • @tanstack/router-utils@1.162.4

     • @tanstack/react-start-server@1.167.50

     • @tanstack/react-start-rsc@0.1.63

2. 1.169.1

   13 October 2026
   Updated dependencies:

   Patch Changes

   • Updated dependencies:

     • @tanstack/start-server-core@1.169.42

     • @tanstack/react-start-server@1.167.49

     • @tanstack/start-plugin-core@1.171.52

     • @tanstack/react-start-rsc@0.1.62

     • @tanstack/start-client-core@1.170.37

     • @tanstack/react-router@1.170.44

     • @tanstack/react-start-client@1.168.42

3. 1.169.0

   12 October 2026
   CreateServerEntry keeps the complete callback, including custom error handling, inside the request context and converts errors that escape it. The built-in entry still converts errors automatically. Raw createStartHandler handlers now rethrow the original error. For custom reporting, catch inside createServerEntry, then rethrow for default conversion or return handleStartError(error) to preserve response-helper status, headers, and cookies. Return an explicit Response when choosing a custom error payload.Response helpers now apply consistently across server routes, SSR, server functions, redirects, errors, and middleware response replacements. Helper setters override returned values; cookie helpers preserve independent cookies and replace matching cookie identities. Use appendResponseHeader('set-cookie', cookie) when adding a serialized cookie without replacing other cookies. Changed responses receive copied headers and reuse the body stream, so applications should inspect the response returned by Start rather than relying on mutation of the original response.

   Minor Changes

   • • TanStack Start is stable. To upgrade from a release candidate, follow Migrate from the Release Candidate.

   Patch Changes

   • • Remove the deprecated .inputValidator() from createServerFn and createMiddleware. Use .validator(), which takes the same validator.

   • • Keep streaming a page when request middleware returns a response that reads the page body, such as a copy made through a wrapped global Response, a copy in Bun, or a body piped through a transform. Start now disposes a replaced page stream only when nothing reads it. transferResponseBodyOwnership is removed: return the derived response directly.

   • • Remove the built-in useSession API. Applications choose a session library, such as iron-session, and save or destroy sessions explicitly before returning or redirecting. Connect a cookie adapter through getCookie and setCookie, or append serialized cookies with appendResponseHeader('set-cookie', cookie). Existing session cookies require a deliberate migration or signing in again with a new cookie name.

     createServerEntry keeps the complete callback, including custom error handling, inside the request context and converts errors that escape it. The built-in entry still converts errors automatically. Raw createStartHandler handlers now rethrow the original error. For custom reporting, catch inside createServerEntry, then rethrow for default conversion or return handleStartError(error) to preserve response-helper status, headers, and cookies. Return an explicit Response when choosing a custom error payload.

     Response helpers now apply consistently across server routes, SSR, server functions, redirects, errors, and middleware response replacements. Helper setters override returned values; cookie helpers preserve independent cookies and replace matching cookie identities. Use appendResponseHeader('set-cookie', cookie) when adding a serialized cookie without replacing other cookies. Changed responses receive copied headers and reuse the body stream, so applications should inspect the response returned by Start rather than relying on mutation of the original response.

   • • Require Vite 8 for Vite builds. Vite 7 is no longer supported.

   • Updated dependencies:

     • @tanstack/start-server-core@1.169.41

     • @tanstack/start-client-core@1.170.36

     • @tanstack/start-plugin-core@1.171.51

     • @tanstack/react-start-server@1.167.48

     • @tanstack/react-start-rsc@0.1.61

     • @tanstack/react-router@1.170.43

     • @tanstack/react-start-client@1.168.41

4. 1.168.61

   10 October 2026
   Updated dependencies:

   Patch Changes

   • Updated dependencies:

     • @tanstack/react-router@1.170.42

     • @tanstack/start-plugin-core@1.171.50

     • @tanstack/start-server-core@1.169.40

     • @tanstack/react-start-client@1.168.40

     • @tanstack/react-start-rsc@0.1.60

     • @tanstack/react-start-server@1.167.47

     • @tanstack/start-client-core@1.170.35

5. 1.168.60

   30 September 2026
   Updated dependencies:

   Patch Changes

   • Updated dependencies:

     • @tanstack/react-router@1.170.41

     • @tanstack/start-plugin-core@1.171.49

     • @tanstack/start-server-core@1.169.39

     • @tanstack/react-start-client@1.168.39

     • @tanstack/react-start-rsc@0.1.59

     • @tanstack/react-start-server@1.167.46

     • @tanstack/start-client-core@1.170.34

6. 1.168.59

   27 September 2026
   Updated dependencies:

   Patch Changes

   • Updated dependencies:

     • @tanstack/react-router@1.170.40

     • @tanstack/start-client-core@1.170.33

     • @tanstack/start-server-core@1.169.38

     • @tanstack/start-plugin-core@1.171.48

     • @tanstack/react-start-client@1.168.38

     • @tanstack/react-start-rsc@0.1.58

     • @tanstack/react-start-server@1.167.45

7. 1.168.58

   23 September 2026
   Updated dependencies:

   Patch Changes

   • Updated dependencies:

     • @tanstack/react-router@1.170.39

     • @tanstack/react-start-client@1.168.37

     • @tanstack/react-start-rsc@0.1.57

     • @tanstack/react-start-server@1.167.44

8. 1.168.57

   21 September 2026
   Updated dependencies:

   Patch Changes

   • Updated dependencies:

     • @tanstack/start-plugin-core@1.171.47

     • @tanstack/react-start-rsc@0.1.56

9. 1.168.56

   16 September 2026
   Updated dependencies []:

   Patch Changes

   • Updated dependencies []:

     • @tanstack/react-router@1.170.38

     • @tanstack/react-start-client@1.168.36

     • @tanstack/react-start-rsc@0.1.55

     • @tanstack/react-start-server@1.167.43

     • @tanstack/start-client-core@1.170.32

     • @tanstack/start-plugin-core@1.171.46

     • @tanstack/start-server-core@1.169.37

10. 1.168.55

    16 September 2026
    Updated dependencies:

    Patch Changes

    • Updated dependencies:

      • @tanstack/react-router@1.170.37

      • @tanstack/start-plugin-core@1.171.45

      • @tanstack/start-client-core@1.170.31

      • @tanstack/start-server-core@1.169.36

      • @tanstack/react-start-client@1.168.35

      • @tanstack/react-start-rsc@0.1.54

      • @tanstack/react-start-server@1.167.42