TanStack Start: Reflected cross-site scripting in server-function responses
Summary
Several TanStack Start packages allow an unauthenticated attacker to place crafted input in a server-function request so that the server returns attacker-controlled HTML from the application's own origin. If a visitor opens such a crafted URL, injected script can access same-origin data and send requests with the visitor's authority. The attack requires the victim to open a manipulated link, and the CVSS score is 9.3 (critical).
Affected
- @tanstack/start-server-core from 1.143.12 before 1.169.39
- @tanstack/react-start from 1.143.12 before 1.168.60
- @tanstack/solid-start from 1.143.12 before 1.168.57
- @tanstack/vue-start from 1.143.12 before 1.168.56
Fixed in
- @tanstack/start-server-core 1.169.39
- @tanstack/react-start 1.168.60
- @tanstack/solid-start 1.168.57
- @tanstack/vue-start 1.168.56
Workaround
Unknown. Upgrading is the vendor's recommended remedy. Edge or WAF rules on the server-function path and a restrictive Content-Security-Policy are interim stopgaps only and do not replace patching.
Exploitation
- No confirmed active exploitation found at time of research.
- No public proof of concept found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Check lockfiles and build pipelines for the affected packages, including transitive versions of @tanstack/start-server-core.
- Upgrade to the fixed versions, rebuild and redeploy; test SSR in staging first, as third-party reports describe compatibility issues with router versions.
- Until patched, restrict access to affected apps where possible and add a restrictive Content-Security-Policy.
- Inform staff that crafted links to these applications may be used in phishing.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- TanStack security update CVE-2026-102989 tanstack.com
- GitHub Security Advisory GHSA-qx66-fv34-fjm8 github.com
- Fix commit d521abd github.com
- Pull request #8573 github.com
- Release release-2026-09-30-1747 github.com
- OSV CVE-2026-102989 osv.dev
- Netlify changelog www.netlify.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:18.
Original description (NVD)
TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an unauthenticated attacker can place non-public fields in a server-function request payload so that attacker-controlled middleware state reaches the error path and a response-shaped object is accepted as an HTTP response. A crafted server-function URL can therefore return attacker-controlled HTML from the application's origin; when a visitor opens the URL, the injected script can access same-origin data and issue requests with the visitor's authority. This issue is fixed in @tanstack/start-server-core 1.169.39, @tanstack/react-start 1.168.60, @tanstack/solid-start 1.168.57, and @tanstack/vue-start 1.168.56.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.