Skip to main content
cve.nowby Sazabi
Rankings

Rankings: This year's worst packages

Open source packages ranked by the score of their worst CVE published or escalated in the window, then by how many they have. How the score works.

  1. 192react-server-dom-parcelWorst: CVE-2025-55182 · Meta react-server-dom-webpack · Meta react-server-dom-tu… +4: Pre-auth remote code execution in server function endpointsnpm8 CVEs in this window
  2. 292react-server-dom-turbopackWorst: CVE-2025-55182 · Meta react-server-dom-webpack · Meta react-server-dom-tu… +4: Pre-auth remote code execution in server function endpointsnpm8 CVEs in this window
  3. 392react-server-dom-webpackWorst: CVE-2025-55182 · Meta react-server-dom-webpack · Meta react-server-dom-tu… +4: Pre-auth remote code execution in server function endpointsnpm8 CVEs in this window
  4. 492starletteWorst: CVE-2026-48710 · Kludex starlette · starlette: Security check bypass via unvalidated Host headerPyPI3 CVEs in this window
  5. 592@tanstack/react-startWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm2 CVEs in this window
  6. 692@tanstack/solid-startWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm2 CVEs in this window
  7. 792@tanstack/start-server-coreWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm2 CVEs in this window
  8. 892@tanstack/vue-startWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm2 CVEs in this window
  9. 992github.com/andybalholm/brotliWorst: CVE-2026-111497 · Google Brotli · node +7: Out-of-bounds write in decompression decoderGo1 CVE in this window
  10. 1092@tanstack/arktype-adapterWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  11. 1192@tanstack/eslint-plugin-routerWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  12. 1292@tanstack/eslint-plugin-startWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  13. 1392@tanstack/historyWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  14. 1492@tanstack/nitro-v2-vite-pluginWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  15. 1592@tanstack/react-routerWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  16. 1692@tanstack/react-router-devtoolsWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  17. 1792@tanstack/react-router-ssr-queryWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  18. 1892@tanstack/react-start-clientWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  19. 1992@tanstack/react-start-rscWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  20. 2092@tanstack/react-start-serverWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  21. 2192@tanstack/router-cliWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  22. 2292@tanstack/router-coreWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  23. 2392@tanstack/router-devtoolsWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  24. 2492@tanstack/router-devtools-coreWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  25. 2592@tanstack/router-generatorWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  26. 2692@tanstack/router-pluginWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  27. 2792@tanstack/router-ssr-query-coreWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  28. 2892@tanstack/router-utilsWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  29. 2992@tanstack/router-vite-pluginWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  30. 3092@tanstack/solid-routerWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  31. 3192@tanstack/solid-router-devtoolsWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  32. 3292@tanstack/solid-router-ssr-queryWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  33. 3392@tanstack/solid-start-clientWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  34. 3492@tanstack/solid-start-serverWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  35. 3592@tanstack/start-client-coreWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  36. 3692@tanstack/start-fn-stubsWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  37. 3792@tanstack/start-plugin-coreWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  38. 3892@tanstack/start-static-server-functionsWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  39. 3992@tanstack/start-storage-contextWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  40. 4092@tanstack/valibot-adapterWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  41. 4192@tanstack/virtual-file-routesWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  42. 4292@tanstack/vue-routerWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  43. 4392@tanstack/vue-router-devtoolsWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  44. 4492@tanstack/vue-router-ssr-queryWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  45. 4592@tanstack/vue-start-clientWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  46. 4692@tanstack/vue-start-serverWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  47. 4792@tanstack/zod-adapterWorst: CVE-2026-45321 · @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: Malware in @tanstack/* npm packages steals credentialsnpm1 CVE in this window
  48. 4892brotliWorst: CVE-2026-111497 · Google Brotli · node +7: Out-of-bounds write in decompression decoderPyPI1 CVE in this window
  49. 4992brotlicffiWorst: CVE-2026-111497 · Google Brotli · node +7: Out-of-bounds write in decompression decoderPyPI1 CVE in this window
  50. 5091litellmWorst: CVE-2026-59822 · BerriAI litellm · litellm: Auth bypass in MCP Streamable HTTP endpointPyPI13 CVEs in this window

Do you depend on one of these? Scan your lockfile.