Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

tanstack/router

              main @ 3d86aee
            

Fixes

CVEs

CRITICAL

Peak severity

20.0%

Coverage

Highlights

Auth Bypass: 6 prior fixes. Scrutinize any change in this area.

@tanstack/start-server-core: most-fixed (2 issues). Treat as high-risk during review.

12 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Context pollution during server function execution allowed client-supplied properties to override and spoof server-side middleware context, leading to potential authentication bypass. Developers must prioritize server middleware context over client properties.

Auth Bypass: Nested star-export chains of server function factories could bypass authentication middleware if not recursively resolved. Ensuring complete AST/bundle-level tracing is critical.

CSRF: Server-side function handlers were vulnerable to cross-site requests. Automatic application of Fetch Metadata checks (Sec-Fetch-Site) and Origin verification is required to safely execute these RPC-like endpoints.