critical · 9.3 Patched

TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

CVE-2026-102989 · GHSA-qx66-fv34-fjm8 · published 15 Oct 2026

How serious is it

Severity: critical, CVSS score 9.3 out of 10.
No exploit prediction (EPSS) score yet.
Not on the CISA list of exploited vulnerabilities.
No public exploit in Exploit-DB.

Is your app affected by CVE-2026-102989?

Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.

Who is affected

@tanstack/start-server-core (npm) >= 1.143.12, < 1.169.39
@tanstack/react-start (npm) >= 1.143.12, < 1.168.60
@tanstack/solid-start (npm) >= 1.143.12, < 1.168.57
@tanstack/vue-start (npm) >= 1.143.12, < 1.168.56

How to check

Run npm ls @tanstack/start-server-core in your project to see the installed version, including copies pulled in by other packages.
Run npm ls @tanstack/react-start in your project to see the installed version, including copies pulled in by other packages.
Run npm ls @tanstack/solid-start in your project to see the installed version, including copies pulled in by other packages.
Run npm ls @tanstack/vue-start in your project to see the installed version, including copies pulled in by other packages.
Or paste your lockfile into the checker: it lists every package with a known vulnerability, this one included.
Or run npx shippable-dev scan localhost:3000 in your project folder. It reads your lockfile and flags this vulnerability along with every other known one.

How to fix

Copies a prompt for Claude Code, Cursor or Codex: it checks your lockfiles for this and upgrades it.

On >= 1.143.12, < 1.169.39: Upgrade @tanstack/start-server-core to 1.169.39 or later, commit the lockfile and redeploy.
On >= 1.143.12, < 1.168.60: Upgrade @tanstack/react-start to 1.168.60 or later, commit the lockfile and redeploy.
On >= 1.143.12, < 1.168.57: Upgrade @tanstack/solid-start to 1.168.57 or later, commit the lockfile and redeploy.
On >= 1.143.12, < 1.168.56: Upgrade @tanstack/vue-start to 1.168.56 or later, commit the lockfile and redeploy.
If a vulnerable version was live, check your logs and rotate the secrets that server could read.

The advisory

## Impact An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that visitor and make requests with their authority. ## Cause The server-function transport can pass request payload fields into internal middleware state instead of limiting them to public input fields. A malformed payload can leave an attacker-controlled result in the error path. Response handling can then treat a response-shaped object as an HTTP response. ## Affected versions Published versions of `@tanstack/start-server-core`, `@tanstack/react-start`, `@tanstack/solid-start`, and `@tanstack/vue-start` from `1.143.12` up to, but not including, their respective patched versions are affected. The patched versions are `@tanstack/start-server-core@1.169.39`, `@tanstack/react-start@1.168.60`, `@tanstack/solid-start@1.168.57`, and `@tanstack/vue-start@1.168.56`. ## Fix The fix limits client-supplied server-function input to public fields and validates responses at the server boundary. Upgrade to the corresponding patched package version. ## Temporary mitigations For the configured server-function path, usually `/_serverFn/*`, an edge or WAF rule can consider blocking requests without the literal `x-tsr-serverFn: true` header and browser document navigations such as `Sec-Fetch-Mode: navigate` or `Accept: text/html`. A restrictive Content Security Policy on server-function responses can provide another browser-side restriction. These are mitigation suggestions, not a complete fix. The header is client-controlled and is not authentication. Test rules against legitimate GET and POST server functions and use a matching version-specific backport where possible. ## Credits Lovable helped us discover and report this issue. We thank them for their help.

Check your whole app

Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.

References

Merged from GitHub Advisory Database. Last updated 23 Oct 2026. All vulnerabilities · RSS · JSON

Get alerts for new exploited vulnerabilities