# CVE-2026-102989: TanStack Start reflected XSS in server-function responses

Source: https://junglewise.ai/threats/cve-2026-102989-tanstack-router-unauthenticated-reflected-xss-in-tanstack-start  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-15  
License: CC BY 4.0 with a link back

CVE-2026-102989 · Severity: critical · CVSS 9.3 · Published 2026-10-13

TanStack Start is a web framework used to build full-stack JavaScript applications. An unauthenticated attacker can craft a malicious URL that tricks users into opening it; when they do, the framework executes the attacker's JavaScript in the user's browser, allowing theft of sensitive data or unauthorized actions on their behalf.

Technologies: [@tanstack/start-server-core (npm)](https://junglewise.ai/threats/technologies/tanstack-start-server-core). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [TanStack](https://junglewise.ai/threats/vendors/tanstack).

## Quick answers

**Is CVE-2026-102989 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102989 being exploited in the wild.

**How severe is CVE-2026-102989?** Critical severity, with a CVSS score of 9.3, published 13 October 2026.

**Which products and versions are affected?** @tanstack/react-start (npm) >= 1.143.12, < 1.168.60, SEMVER:introduced=1.143.12,fixed=1.168.60; @tanstack/solid-start (npm) >= 1.143.12, < 1.168.57, SEMVER:introduced=1.143.12,fixed=1.168.57; @tanstack/start-server-core (npm) >= 1.143.12, < 1.169.39, SEMVER:introduced=1.143.12,fixed=1.169.39; @tanstack/vue-start (npm) >= 1.143.12, < 1.168.56, SEMVER:introduced=1.143.12,fixed=1.168.56; and 4 more.

**Is there a fix for CVE-2026-102989?** Yes. @tanstack/react-start (npm): upgrade to 1.168.60 or later; @tanstack/solid-start (npm): upgrade to 1.168.57 or later; @tanstack/start-server-core (npm): upgrade to 1.169.39 or later; @tanstack/vue-start (npm): upgrade to 1.168.56 or later. Until then: Configure edge or WAF rules on the server-function path (usually /_serverFn/*) to block requests missing the x-tsr-serverFn: true header or with browser document navigation indicators (Sec-Fetch-Mode: navigate or Accept: text/html). Additionally, apply a restrictive Content Security Policy to server-function responses for browser-side protection; however, these mitigations are not a complete fix and should be tested against legitimate server functions.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-10-15"
  }
] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102989 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-102989?** Check whether you run @tanstack/react-start (npm), @tanstack/solid-start (npm), @tanstack/start-server-core (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @tanstack/react-start (npm): upgrade to 1.168.60 or later

  ```sh
  npm install @tanstack/react-start@1.168.60
  ```

- @tanstack/solid-start (npm): upgrade to 1.168.57 or later

  ```sh
  npm install @tanstack/solid-start@1.168.57
  ```

- @tanstack/start-server-core (npm): upgrade to 1.169.39 or later

  ```sh
  npm install @tanstack/start-server-core@1.169.39
  ```

- @tanstack/vue-start (npm): upgrade to 1.168.56 or later

  ```sh
  npm install @tanstack/vue-start@1.168.56
  ```


Configure edge or WAF rules on the server-function path (usually /_serverFn/*) to block requests missing the x-tsr-serverFn: true header or with browser document navigation indicators (Sec-Fetch-Mode: navigate or Accept: text/html). Additionally, apply a restrictive Content Security Policy to server-function responses for browser-side protection; however, these mitigations are not a complete fix and should be tested against legitimate server functions.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-10-15"
  }
]

## Technical details

The server-function transport incorrectly passes client-supplied request payload fields into middleware state without validation, allowing a malformed payload to inject attacker-controlled data into error responses. These responses are then treated as legitimate HTTP responses and parsed as HTML, leading to reflected XSS. The vulnerability requires an unauthenticated network request to a server-function endpoint, with no user interaction beyond opening a crafted link.

## Affected products

- TanStack start-server-core 1.143.12 to 1.169.38
- TanStack react-start 1.143.12 to 1.168.59
- TanStack solid-start 1.143.12 to 1.168.56
- TanStack vue-start 1.143.12 to 1.168.55

## Identifiers

- CVE-2026-102989
- GHSA-qx66-fv34-fjm8

## Related threats

- [TanStack Start Server Core type confusion in request deserialization](https://junglewise.ai/threats/tanstack-start-server-core-type-confusion-in-request-deserialization-53e6cf74)
- [TanStack npm packages supply chain compromise via GitHub Actions OIDC hijacking](https://junglewise.ai/threats/cve-2026-45321-tanstack-npm-packages-supply-chain-compromise-via-github-actions)