Is CVE-2026-102989 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102989 being exploited in the wild.

How severe is CVE-2026-102989?

Critical severity, with a CVSS score of 9.3, published 13 October 2026.

Which products and versions are affected?

@tanstack/react-start (npm) >= 1.143.12, = 1.143.12, = 1.143.12, = 1.143.12, < 1.168.56, SEMVER:introduced=1.143.12,fixed=1.168.56; and 4 more.

How is CVE-2026-102989 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-102989?

Check whether you run @tanstack/react-start (npm), @tanstack/solid-start (npm), @tanstack/start-server-core (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102989: TanStack Start reflected XSS in server-function responses

Q: Is there a fix for CVE-2026-102989?

Yes. @tanstack/react-start (npm): upgrade to 1.168.60 or later; @tanstack/solid-start (npm): upgrade to 1.168.57 or later; @tanstack/start-server-core (npm): upgrade to 1.169.39 or later; @tanstack/vue-start (npm): upgrade to 1.168.56 or later. Until then: Configure edge or WAF rules on the server-function path (usually /_serverFn/*) to block requests missing the x-tsr-serverFn: true header or with browser document navigation indicators (Sec-Fetch-Mode: navigate or Accept: text/html). Additionally, apply a restrictive Content Security Policy to server-function responses for browser-side protection; however, these mitigations are not a complete fix and should be tested against legitimate server functions. [ { "kind": "disclosed", "at": "2026-10-15" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-102989 · Severity: critical · CVSS 9.3 · Published 2026-10-13

TanStack Start is a web framework used to build full-stack JavaScript applications. An unauthenticated attacker can craft a malicious URL that tricks users into opening it; when they do, the framework executes the attacker's JavaScript in the user's browser, allowing theft of sensitive data or unauthorized actions on their behalf.

Technologies: @tanstack/start-server-core (npm). Vendors: npm, TanStack.

Quick answers

Is CVE-2026-102989 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102989 being exploited in the wild.
How severe is CVE-2026-102989?: Critical severity, with a CVSS score of 9.3, published 13 October 2026.
Which products and versions are affected?: @tanstack/react-start (npm) >= 1.143.12, < 1.168.60, SEMVER:introduced=1.143.12,fixed=1.168.60; @tanstack/solid-start (npm) >= 1.143.12, < 1.168.57, SEMVER:introduced=1.143.12,fixed=1.168.57; @tanstack/start-server-core (npm) >= 1.143.12, < 1.169.39, SEMVER:introduced=1.143.12,fixed=1.169.39; @tanstack/vue-start (npm) >= 1.143.12, < 1.168.56, SEMVER:introduced=1.143.12,fixed=1.168.56; and 4 more.
Is there a fix for CVE-2026-102989?: Yes. @tanstack/react-start (npm): upgrade to 1.168.60 or later; @tanstack/solid-start (npm): upgrade to 1.168.57 or later; @tanstack/start-server-core (npm): upgrade to 1.169.39 or later; @tanstack/vue-start (npm): upgrade to 1.168.56 or later. Until then: Configure edge or WAF rules on the server-function path (usually /_serverFn/*) to block requests missing the x-tsr-serverFn: true header or with browser document navigation indicators (Sec-Fetch-Mode: navigate or Accept: text/html). Additionally, apply a restrictive Content Security Policy to server-function responses for browser-side protection; however, these mitigations are not a complete fix and should be tested against legitimate server functions.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-10-15" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102989 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-102989?: Check whether you run @tanstack/react-start (npm), @tanstack/solid-start (npm), @tanstack/start-server-core (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@tanstack/react-start (npm): upgrade to 1.168.60 or later
```
npm install @tanstack/react-start@1.168.60
```
@tanstack/solid-start (npm): upgrade to 1.168.57 or later
```
npm install @tanstack/solid-start@1.168.57
```
@tanstack/start-server-core (npm): upgrade to 1.169.39 or later
```
npm install @tanstack/start-server-core@1.169.39
```
@tanstack/vue-start (npm): upgrade to 1.168.56 or later
```
npm install @tanstack/vue-start@1.168.56
```

Configure edge or WAF rules on the server-function path (usually /_serverFn/*) to block requests missing the x-tsr-serverFn: true header or with browser document navigation indicators (Sec-Fetch-Mode: navigate or Accept: text/html). Additionally, apply a restrictive Content Security Policy to server-function responses for browser-side protection; however, these mitigations are not a complete fix and should be tested against legitimate server functions.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-10-15" } ]

Technical details

The server-function transport incorrectly passes client-supplied request payload fields into middleware state without validation, allowing a malformed payload to inject attacker-controlled data into error responses. These responses are then treated as legitimate HTTP responses and parsed as HTML, leading to reflected XSS. The vulnerability requires an unauthenticated network request to a server-function endpoint, with no user interaction beyond opening a crafted link.

Affected products

TanStack start-server-core 1.143.12 to 1.169.38
TanStack react-start 1.143.12 to 1.168.59
TanStack solid-start 1.143.12 to 1.168.56
TanStack vue-start 1.143.12 to 1.168.55

Identifiers

CVE-2026-102989
GHSA-qx66-fv34-fjm8

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.