TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
Impact
An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that visitor and make requests with their authority.
Cause
The server-function transport can pass request payload fields into internal middleware state instead of limiting them to public input fields. A malformed payload can leave an attacker-controlled result in the error path. Response handling can then treat a response-shaped object as an HTTP response.
Affected versions
Published versions of @tanstack/start-server-core, @tanstack/react-start, @tanstack/solid-start, and @tanstack/vue-start from 1.143.12 up to, but not including, their respective patched versions are affected. The patched versions are @tanstack/start-server-core@1.169.39, @tanstack/react-start@1.168.60, @tanstack/solid-start@1.168.57, and @tanstack/vue-start@1.168.56.
Fix
The fix limits client-supplied server-function input to public fields and validates responses at the server boundary. Upgrade to the corresponding patched package version.
Temporary mitigations
For the configured server-function path, usually /_serverFn/*, an edge or WAF rule can consider blocking requests without the literal x-tsr-serverFn: true header and browser document navigations such as Sec-Fetch-Mode: navigate or Accept: text/html. A restrictive Content Security Policy on server-function responses can provide another browser-side restriction. These are mitigation suggestions, not a complete fix. The header is client-controlled and is not authentication. Test rules against legitimate GET and POST server functions and use a matching version-specific backport where possible.
Credits
Lovable helped discover and report this issue.
What to do
Upgrade @tanstack/start-server-core, @tanstack/react-start, @tanstack/solid-start, and @tanstack/vue-start to patched versions @tanstack/start-server-core@1.169.39, @tanstack/react-start@1.168.60, @tanstack/solid-start@1.168.57, and @tanstack/vue-start@1.168.56 respectively. As a temporary mitigation, edge or WAF rules can block requests to /_serverFn/* lacking x-tsr-serverFn: true or matching Sec-Fetch-Mode: navigate/Accept: text/html, alongside applying a restrictive Content Security Policy.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @tanstack/react-start | >= 1.143.12, < 1.168.60 | 1.168.60 |
| npm package | @tanstack/solid-start | >= 1.143.12, < 1.168.57 | 1.168.57 |
| npm package | @tanstack/start-server-core | >= 1.143.12, < 1.169.39 | 1.169.39 |
| npm package | @tanstack/vue-start | >= 1.143.12, < 1.168.56 | 1.168.56 |
References
- https://github.com/TanStack/router/security/advisories/GHSA-qx66-fv34-fjm8
- https://nvd.nist.gov/vuln/detail/CVE-2026-102989
- https://github.com/TanStack/router/pull/8573
- https://github.com/TanStack/router/commit/d521abd71c69f1ff010bb3def4d417cb5fa058cb
- https://github.com/TanStack/router
- https://github.com/TanStack/router/releases/tag/release-2026-09-30-1747
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N- Weakness (CWE)
CWE-79- Platform
- npm
- Package
@tanstack/react-start, @tanstack/solid-start, @tanstack/start-server-core- Disclosed
- 15.10.2026
- Updated
- 15.10.2026 23:19
Sources and licenses · Edited or translated by DockRay; source rights and applicable licenses are retained.
OSV / GitHub Advisory Database - GHSA-qx66-fv34-fjm8 - CC BY 4.0
Vulnerability history: @tanstack/react-start
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 05.2026 10.2026
- Without a fix
- 0
- Exploited in attacks
- 1
Severity breakdown
- Critical 2
Disclosures per year
- 2026: 2
-
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.