Summary
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
Cause
The server-function transport can pass request payload fields into internal middleware state instead of limiting them to public input fields. A malformed payload can leave an attacker-controlled result in the error path. Response handling can then treat a response-shaped object as an HTTP response.
Affected versions
Published versions of @tanstack/start-server-core, @tanstack/react-start, @tanstack/solid-start, and @tanstack/vue-start from 1.143.12 up to, but not including, their respective patched versions are affected. The patched versions are @tanstack/[email protected], @tanstack/[email protected], @tanstack/[email protected], and @tanstack/[email protected].
Temporary mitigations
For the configured server-function path, usually /_serverFn/*, an edge or WAF rule can consider blocking requests without the literal x-tsr-serverFn: true header and browser document navigations such as Sec-Fetch-Mode: navigate or Accept: text/html. A restrictive Content Security Policy on server-function responses can provide another browser-side restriction. These are mitigation suggestions, not a complete fix. The header is client-controlled and is not authentication. Test rules against legitimate GET and POST server functions and use a matching version-specific backport where possible.
Credits
Lovable helped us discover and report this issue. We thank them for their help.
Impact
An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that visitor and make requests with their authority.
Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.
CVE-2026-102989 has a CVSS score of 9.3 (Critical). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.169.39, 1.168.60, 1.168.57, 1.168.56); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
The fix limits client-supplied server-function input to public fields and validates responses at the server boundary. Upgrade to the corresponding patched package version.
Frequently Asked Questions
- What is CVE-2026-102989? CVE-2026-102989 is a critical-severity cross-site scripting (XSS) vulnerability in @tanstack/start-server-core (npm), affecting versions >= 1.143.12, < 1.169.39. It is fixed in 1.169.39, 1.168.60, 1.168.57, 1.168.56. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
- How severe is CVE-2026-102989? CVE-2026-102989 has a CVSS score of 9.3 (Critical). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which packages are affected by CVE-2026-102989?
@tanstack/start-server-core(npm) (versions >= 1.143.12, < 1.169.39)@tanstack/react-start(npm) (versions >= 1.143.12, < 1.168.60)@tanstack/solid-start(npm) (versions >= 1.143.12, < 1.168.57)@tanstack/vue-start(npm) (versions >= 1.143.12, < 1.168.56)
- Is there a fix for CVE-2026-102989? Yes. CVE-2026-102989 is fixed in 1.169.39, 1.168.60, 1.168.57, 1.168.56. Upgrade to this version or later.
- Is CVE-2026-102989 exploitable, and should I be worried? Whether CVE-2026-102989 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-102989 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-102989?
- Upgrade
@tanstack/start-server-coreto 1.169.39 or later - Upgrade
@tanstack/react-startto 1.168.60 or later - Upgrade
@tanstack/solid-startto 1.168.57 or later - Upgrade
@tanstack/vue-startto 1.168.56 or later
- Upgrade