@tanstack/react-start-server (npm) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the npm package @tanstack/react-start-server, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (1)

• CVE-2026-45321 — CVSS 9.6 (critical) — actively exploited: On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm…