TANSTACK CVE-2026-102989 is a high-severity, unauthenticated reflected XSS flaw affecting TanStack Start and its underlying Router. The advisory describes an ability for an attacker to craft a link that, when opened on a vulnerable app, returns attacker-controlled HTML from the app’s own origin and executes the attacker’s JavaScript in the victim’s browser. The flaw is rated CVSS 9.3 (v3) and not yet observed in the wild, with no public PoC confirmed to date.
Public TanStack Start apps that expose server functions are at risk. The vulnerability stems from how server-function responses are generated, allowing the app to return attacker-controlled HTML from its own origin and run JavaScript there, without requiring authentication. Delivery is likely via phishing or chat messages that entice a user to click a malicious link.
The affected ecosystem includes TanStack Start and its Router packages, which together power applications across React, Solid and Vue stacks, with TanStack Start drawing substantial usage, cited as over 98 million monthly npm downloads.
Patched versions are now available. The affected packages and fixes are:
- @tanstack/start-server-core fixed in 1.169.39
- @tanstack/react-start fixed in 1.168.60
- @tanstack/solid-start fixed in 1.168.57
- @tanstack/vue-start fixed in 1.168.56
Mitigations include upgrading to the patched releases or, if upgrading isn’t feasible yet, applying server-function path protections with a strict Content Security Policy or WAF/edge rules. TanStack notes these are mitigations, not a complete fix; upgrading remains the proper remedy. The advisory confirms there is no confirmed exploitation at this time. Date: 14 October 2026.