CVE-2026-102989 TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
An unauthenticated attacker can inject malicious scripts via crafted server-function URLs, allowing same-origin data access and request execution on victim browsers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-102989?
CVE-2026-102989 is a critical cross-site scripting vulnerability in @tanstack react-start, published on 13 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an unauthenticated attacker can place non-public fields in a server-function request payload so that attacker-controlled middleware state reaches the error path and a response-shaped object is accepted as an HTTP response. A crafted server-function URL can therefore return attacker-controlled HTML from the application's origin; when a visitor opens the URL, the injected script can access same-origin data and issue requests with the visitor's authority. This issue is fixed in @tanstack/start-server-core 1.169.39, @tanstack/react-start 1.168.60, @tanstack/solid-start 1.168.57, and @tanstack/vue-start 1.168.56.
Weakness: CWE-79
Which versions are affected by CVE-2026-102989?
8 open source packages ship an affected version, including @tanstack/react-start, @tanstack/solid-start and @tanstack/start-server-core.
| Package | Affected | Fixed in |
|---|---|---|
@tanstack/react-start npm | From 1.143.12 | 1.168.60 |
@tanstack/react-start npm | From 1.143.12 | 1.168.60 |
@tanstack/solid-start npm | From 1.143.12 | 1.168.57 |
@tanstack/solid-start npm | From 1.143.12 | 1.168.57 |
@tanstack/start-server-core npm | From 1.143.12 | 1.169.39 |
@tanstack/start-server-core npm | From 1.143.12 | 1.169.39 |
2 more packages
@tanstack/vue-start npm | From 1.143.12 | 1.168.56 |
@tanstack/vue-start npm | From 1.143.12 | 1.168.56 |
How do I fix CVE-2026-102989?
Upgrade @tanstack/react-start to 1.168.60 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-102989 being exploited?
There is no known exploitation of CVE-2026-102989 in the wild and no public exploit code.
Sources
Also known as GHSA-qx66-fv34-fjm8.