GHSA-9M65-766C-R333: Type Confusion in Seroval Leading to Unintended Function Execution in TanStack Start

Vulnerability ID: GHSA-9M65-766C-R333

CVSS Score: 7.1

Published: 2026-05-14

A type confusion vulnerability in the seroval deserialization library (CWE-843) exposes TanStack Start server functions to unintended sibling function invocation. Upstream, this flaw can lead to remote code execution (CVE-2026-23737).

TL;DR

TanStack Start is vulnerable to deserialization type confusion via the seroval library. Attackers can craft JSON payloads to silently trigger unintended server functions, bypassing request-level middleware and audit logs.

⚠️ Exploit Status: POC

Technical Details

CWE ID : CWE-843

Attack Vector : Network

Upstream CVSS : 7.1

TanStack Start CVSS : Low

Impact : Unintended Function Execution / Upstream RCE

Exploit Status : Theoretical / Multi-stage

Affected Systems

TanStack Start Server Core

Seroval Deserialization Library

React Server Components utilizing affected TanStack…