@tanstack/start-server-core

1.169.44 · 16 Oct 2026MIT7.2M / weekRepository Homepage npm Atom feed

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Is your project affected?

Paste your package.json, or type the range you declare for @tanstack/start-server-core. It is read in your browser and sent nowhere.

Line	Newest	Where it stands
	1.169.44	Safe from 1.169.39

Your version

Critical
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responsesGHSA-qx66-fv34-fjm8 · 15 Oct 2026
- 1.x1.143.12 – 1.169.38Fixed in 1.169.39
Critical
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysGHSA-g7cv-rxg3-hmpx · 12 May 2026
- 1.x1.167.33 – 1.167.36Fixed in 1.168.0
Moderate
TanStack Start - Server Core: Inbound server-function request deserialization could invoke a sibling client-referenced server functionGHSA-9m65-766c-r333 · 14 May 2026
- 1.x1.114.5 – 1.167.29Fixed in 1.167.30
Malicious
Malicious code in @tanstack/start-server-core (npm)MAL-2026-3490 · 12 May 2026
Named versions only: 1.167.36 · 1.167.33. 1.169.44 is safe.

Quality and security signals

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.