Read the docs
TI-2026-71939 Aliases CVE-2026-102989GHSA-qx66-fv34-fjm8

Reflected cross-site scripting in TanStack Start server functions

Priority MEDIUM 43CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Affected are @tanstack/start-server-core before 1.169.39, @tanstack/react-start before 1.168.60, @tanstack/solid-start before 1.168.57, and @tanstack/vue-start before 1.168.56, starting from 1.143.12. The flaw is a cross-site scripting weakness (CWE-79) in which attacker-controlled HTML is returned from the application's origin. An unauthenticated remote attacker can craft a server-function URL that a visitor opens, and the injected script can access same-origin data and act with the visitor's authority.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an unauthenticated attacker can place non-public fields in a server-function request payload so that attacker-controlled middleware state reaches the error path and a response-shaped object is accepted as an HTTP response. A crafted server-function URL can therefore return attacker-controlled HTML from the application's origin; when a visitor opens the URL, the injected script can access same-origin data and issue requests with the visitor's authority. This issue is fixed in @tanstack/start-server-core 1.169.39, @tanstack/react-start 1.168.60, @tanstack/solid-start 1.168.57, and @tanstack/vue-start 1.168.56.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00544 45th percentileScored 2026-11-07
Fix Fixed react-start (@tanstack): 1.168.60solid-start (@tanstack): 1.168.57+6 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TanStackrouter< release-2026-09-30-1747—No fix listedCNA
TanStackreact-start1.143.12 to before 1.168.601.168.60Patch availableCNA
TanStacksolid-start1.143.12 to before 1.168.571.168.57Patch availableCNA
TanStackstart-server-core1.143.12 to before 1.169.391.169.39Patch availableCNA
TanStackvue-start1.143.12 to before 1.168.561.168.56Patch availableCNA
—@tanstack/start-server-core (npm)1.143.12 to before 1.169.391.169.39Patch availableGHSA-qx66-fv34-fjm8
—@tanstack/react-start (npm)1.143.12 to before 1.168.601.168.60Patch availableGHSA-qx66-fv34-fjm8
—@tanstack/solid-start (npm)1.143.12 to before 1.168.571.168.57Patch availableGHSA-qx66-fv34-fjm8
—@tanstack/vue-start (npm)1.143.12 to before 1.168.561.168.56Patch availableGHSA-qx66-fv34-fjm8
  • router VendorTanStack Affected < release-2026-09-30-1747 Fixed in — No fix listed CNA
  • react-start VendorTanStack Affected 1.143.12 to before 1.168.60 Fixed in 1.168.60 Patch available CNA
  • solid-start VendorTanStack Affected 1.143.12 to before 1.168.57 Fixed in 1.168.57 Patch available CNA
  • start-server-core VendorTanStack Affected 1.143.12 to before 1.169.39 Fixed in 1.169.39 Patch available CNA
  • vue-start VendorTanStack Affected 1.143.12 to before 1.168.56 Fixed in 1.168.56 Patch available CNA
  • @tanstack/start-server-core (npm) Vendor— Affected 1.143.12 to before 1.169.39 Fixed in 1.169.39 Patch available GHSA-qx66-fv34-fjm8
  • @tanstack/react-start (npm) Vendor— Affected 1.143.12 to before 1.168.60 Fixed in 1.168.60 Patch available GHSA-qx66-fv34-fjm8
  • @tanstack/solid-start (npm) Vendor— Affected 1.143.12 to before 1.168.57 Fixed in 1.168.57 Patch available GHSA-qx66-fv34-fjm8
  • @tanstack/vue-start (npm) Vendor— Affected 1.143.12 to before 1.168.56 Fixed in 1.168.56 Patch available GHSA-qx66-fv34-fjm8

Remediation

Upgrade @tanstack/start-server-core to 1.169.39, @tanstack/react-start to 1.168.60, @tanstack/solid-start to 1.168.57, and @tanstack/vue-start to 1.168.56. The sources list no fixed version for TanStack Router.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

  • Fix · CNA react-start (@tanstack) Fixed in 1.168.60
  • Fix · CNA solid-start (@tanstack) Fixed in 1.168.57
  • Fix · CNA start-server-core (@tanstack) Fixed in 1.169.39
  • Fix · CNA vue-start (@tanstack) Fixed in 1.168.56
  • Fix · GHSA-qx66-fv34-fjm8 @tanstack/start-server-core (npm) Fixed in 1.169.39 Advisory →
  • Fix · GHSA-qx66-fv34-fjm8 @tanstack/react-start (npm) Fixed in 1.168.60 Advisory →
  • Fix · GHSA-qx66-fv34-fjm8 @tanstack/solid-start (npm) Fixed in 1.168.57 Advisory →
  • Fix · GHSA-qx66-fv34-fjm8 @tanstack/vue-start (npm) Fixed in 1.168.56 Advisory →

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-102989
  2. 2026-10-14 CISA SSVC decision points changed
  3. 2026-10-14 Priority changed: MEDIUM → LOW
  4. 2026-10-14 Priority changed: LOW → MEDIUM
  5. 2026-10-16 Alias added: GHSA-qx66-fv34-fjm8
  6. 2026-10-16 Fix available: npm/@tanstack/[email protected], npm/@tanstack/[email protected], npm/@tanstack/[email protected] +1 · GHSA-qx66-fv34-fjm8
  7. 2026-10-16 CVSS score added · GHSA-qx66-fv34-fjm8
  8. 2026-10-16 Weakness changed · GHSA-qx66-fv34-fjm8
  9. 2026-10-16 6 new references · GHSA-qx66-fv34-fjm8

References

Advisory 1

Other 5

  • TI-2026-33119 Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys KEVCVSS 3.1CRITICAL 9.6
  • TI-2026-13131 tanstack db Alias Path select.ts select prototype pollution CVSS 4.0MEDIUM 5.3
  • TI-2026-54372 TanStack devtools-vite Development Devtools Event Bus package-manager.ts installPackage os command injection CVSS 4.0LOW 2.0
  • TI-2024-16179 react-query-streamed-hydration xss CVSS 3.1HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences