TanStack CVE-2026-102989 (CVSS 9.3) Reflected XSS Hits Ecosystem With 98M Monthly Downloads
Do Son 
TL;DR
TanStack has fixed CVE-2026-102989, an unauthenticated reflected XSS flaw rated CVSS 9.3. This TanStack Start vulnerability lets a crafted link run attacker JavaScript on an app’s own domain. Patched packages are available now.
- CVE: CVE-2026-102989
- CVSS: 9.3 (Critical · CVSSv3)
- Product: TanStack router
- Affected: < release-2026-09-30-1747, >= 1.143.12, < 1.168.60, >= 1.143.12, < 1.168.57, >= 1.143.12, < 1.169.39, >= 1.143.12, < 1.168.56
- Impact: TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
- Status: No confirmed exploitation yet
- Action: See vendor advisory
Why It Matters
TanStack builds widely used tools for React, Solid and Vue apps. Its Router package draws over 98 million npm downloads a month, according to the project. TanStack Start, the full-stack framework built on it, carries the bug.
The TanStack security advisory warns: “The script can access same-origin data available to that visitor and make requests with their authority.”
How the Attack Works
An attacker crafts a URL that targets a server function in an affected app. When a victim opens it, a flaw in how the server handles malformed requests lets attacker-controlled HTML come back from the app’s own origin. In the advisory’s words, “the app can return attacker-controlled HTML from its own origin and run the attacker’s JavaScript there.” No login is required.
Who is at risk
Any public TanStack Start app that exposes server functions is a potential target. Because this is a reflected XSS flaw, attackers only need a victim to click a link. Phishing emails and chat messages are the likely delivery routes.
Exploitation status
No exploitation in the wild has been confirmed. Likewise, no public proof-of-concept has been confirmed.
Affected Versions
Versions from 1.143.12 up to the patched releases are affected in these packages:
- @tanstack/start-server-core (fixed in 1.169.39)
- @tanstack/react-start (fixed in 1.168.60)
- @tanstack/solid-start (fixed in 1.168.57)
- @tanstack/vue-start (fixed in 1.168.56)
Patch and Mitigation Steps
- Upgrade to the patched package version for your framework.
- If you cannot update yet, add WAF or edge rules on the server-function path and a strict Content Security Policy.
TanStack stresses that these stopgaps “are mitigation suggestions, not a complete fix.” Upgrading remains the only full answer to this TanStack Start vulnerability.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
