@tanstack react-start

• CVE-2026-45321 Critical 9.6 Exploited Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys 3.3%
• CVE-2026-102989 Critical 9.3 TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses 0.5%