{"action":"Upgrade @tanstack/start-server-core to 1.167.30 or later.","affected":[{"fixed":"1.167.30","introduced":"0"}],"component":"@tanstack/start-server-core","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["1.167.30"],"ghsa_id":"GHSA-9m65-766c-r333","id":"tcs_01M5KFG60Y1PTTT7CQ76CKQVPJ","modified_at":"2026-05-14T16:57:38.668905Z","published_at":"2026-05-14T16:37:10Z","references":["https://osv.dev/vulnerability/GHSA-9m65-766c-r333","https://github.com/TanStack/router/security/advisories/GHSA-9m65-766c-r333","https://github.com/TanStack/router","https://github.com/lxsmnsyc/seroval/security/advisories"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-9m65-766c-r333","url":"https://osv.dev/vulnerability/GHSA-9m65-766c-r333"}],"summary":"TanStack Start - Server Core: Inbound server-function request deserialization could invoke a sibling client-referenced server function"}