TanStack Router XSS Patch Available for Start Framework Packages

Organisations using TanStack Start frameworks must update their router packages immediately to address a critical cross-site scripting vulnerability. The flaw, tracked as CVE-2026-102989, allows unauthenticated attackers to inject malicious scripts into web applications. Patches are now available for specific versions of the @tanstack/start-server-core, @tanstack/react-start, @tanstack/solid-start, and @tanstack/vue-start packages.

How it unfolded

• Lovable discovered the vulnerability and reported it to the TanStack maintainers.
• The issue stems from how server-function transport handles request payload fields.
• Attackers could place non-public fields in payloads to manipulate middleware state.
• This manipulation allowed attacker-controlled HTML to be returned from the application origin.

Who is affected

The vulnerability impacts TanStack Router users running versions from 1.143.12 up to the patched releases. Specifically, @tanstack/start-server-core versions below 1.169.39 are vulnerable. Similarly, @tanstack/react-start versions below 1.168.60, @tanstack/solid-start below 1.168.57, and @tanstack/vue-start below 1.168.56 are affected. The National Vulnerability Database rates the severity as critical with a CVSS score of 9.3.

Our take on the response

The fix involves limiting client-supplied input to public fields and validating responses at the server boundary. This approach prevents the malformed payloads from reaching the error path where they could be treated as HTTP responses. The vendor has provided clear version boundaries for the patches, allowing teams to quickly identify if their environment is at risk.

Who needs to act first

Teams should prioritise updating publicly accessible applications that use server functions. Check whether your deployment pipeline can safely roll out the patched package versions. Before upgrading, back up your current application state to allow for quick rollback if issues arise. Test the update in a staging environment to ensure compatibility with existing middleware. If immediate patching is not possible, consider implementing temporary mitigations such as blocking requests without specific headers. Monitor logs for unusual activity from server function endpoints.

What to do and how to stay safe: TanStack

• Audit your project dependencies to identify if you are using vulnerable versions of TanStack Start packages.
• Update to the patched versions: @tanstack/start-server-core 1.169.39, @tanstack/react-start 1.168.60, @tanstack/solid-start 1.168.57, and @tanstack/vue-start 1.168.56.
• Implement temporary mitigations by blocking requests to server function paths that lack the `x-tsr-serverFn: true` header or specific browser navigation headers.
• Enforce a restrictive Content Security Policy on server-function responses to limit the impact of any injected scripts.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-102989?

It is a critical cross-site scripting vulnerability in TanStack Router that allows attackers to inject malicious scripts via crafted server function URLs.

Which packages are affected?

@tanstack/start-server-core, @tanstack/react-start, @tanstack/solid-start, and @tanstack/vue-start versions from 1.143.12 up to their respective patched versions.

Is there a fix available?

Yes, patches are available for all affected packages, with specific version numbers provided for each.