@tanstack/react-start
1.169.3 · 16 Oct 2026MIT7.2M / weekRepositoryHomepagenpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for @tanstack/react-start. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 1.169.3 | Safe from 1.168.60 |
- CriticalTanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responsesGHSA-qx66-fv34-fjm8 · 15 Oct 2026
- 1.x1.143.12 – 1.168.59Fixed in 1.168.60
- CriticalMalware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysGHSA-g7cv-rxg3-hmpx · 12 May 2026
- 1.x1.167.68 – 1.167.71Fixed in 1.168.0
- MaliciousMalicious code in @tanstack/react-start (npm)MAL-2026-3468 · 11 May 2026
Named versions only: 1.167.71 · 1.167.68. 1.169.3 is safe.
Quality and security signals
What npm and deps.dev say about the latest release. Signals, not a verdict.
- Licence
- ProvenancePresent, built from github.com/TanStack/routerSays where the release was built and from which commit. It does not say the code is safe.
- Published byGitHub Actions
- Maintainers on npm
- Size
- GitHub stars15,211 on tanstack/router
- Last release1.169.3, 16 October 2026
- OpenSSF ScorecardNo Scorecard for this repository
Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.