CVE-2026-102989: TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an unauthenticated attacker can place non-public fields in a server-function request payload so that attacker-controlled middleware state reaches the error path and a response-shaped object is accepted as an HTTP response. A crafted server-function URL can therefore return attacker-controlled HTML from the application's origin; when a visitor opens the URL, the injected script can access same-origin data and issue requests with the visitor's authority. This issue is fixed in @tanstack/start-server-core 1.169.39, @tanstack/react-start 1.168.60, @tanstack/solid-start 1.168.57, and @tanstack/vue-start 1.168.56.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@tanstack/start-server-coreto a version that resolves this vulnerability.Fixed in 1.169.39 - Upgrade
Upgrade
@tanstack/react-startto a version that resolves this vulnerability.Fixed in 1.168.60 - Upgrade
Upgrade
@tanstack/solid-startto a version that resolves this vulnerability.Fixed in 1.168.57 - Upgrade
Upgrade
@tanstack/vue-startto a version that resolves this vulnerability.Fixed in 1.168.56
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using affected versions of @tanstack/start-server-core, @tanstack/react-start, @tanstack/solid-start, or @tanstack/vue-start are exposed because a crafted server-function URL can serve attacker-controlled HTML from the application’s own origin. Exploitation does not require authentication, but it requires a visitor to open the crafted URL.
What can an attacker do after a victim opens an exploit URL?
Injected script executes from the application origin, allowing it to access same-origin data and make requests with the victim’s authority. The reported impact includes high confidentiality and integrity impact, while availability impact is not indicated.
Which versions contain the fixes?
Upgrade to @tanstack/start-server-core 1.169.39, @tanstack/react-start 1.168.60, @tanstack/solid-start 1.168.57, or @tanstack/vue-start 1.168.56. The affected @tanstack/start-server-core range begins at 1.143.12; the provided data does not identify earlier versions as affected.