CVE-2026-102989
Received Received - Intake

XSS via Server-Function Payload in TanStack Router

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description
TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an unauthenticated attacker can place non-public fields in a server-function request payload so that attacker-controlled middleware state reaches the error path and a response-shaped object is accepted as an HTTP response. A crafted server-function URL can therefore return attacker-controlled HTML from the application's origin; when a visitor opens the URL, the injected script can access same-origin data and issue requests with the visitor's authority. This issue is fixed in @tanstack/start-server-core 1.169.39, @tanstack/react-start 1.168.60, @tanstack/solid-start 1.168.57, and @tanstack/vue-start 1.168.56.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-102989
EUVD
EUVD-2026-98849

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
TanStack router < release-2026-09-30-1747
@tanstack react-start >= 1.143.12, < 1.168.60
@tanstack solid-start >= 1.143.12, < 1.168.57
@tanstack start-server-core >= 1.143.12, < 1.169.39
@tanstack vue-start >= 1.143.12, < 1.168.56

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in TanStack Router allows an unauthenticated attacker to inject non-public fields into a server-function request payload. This can manipulate middleware state to reach the error path, causing the application to accept a response-shaped object as an HTTP response. The attacker can craft a server-function URL that returns attacker-controlled HTML from the application's origin. When a visitor opens this URL, the injected script can access same-origin data and issue requests with the visitor's authority.

Impact Analysis

If exploited, this vulnerability allows attackers to execute malicious scripts in the context of your application's origin. This can lead to unauthorized access to sensitive data, session hijacking, or performing actions on behalf of users without their consent. Visitors to a crafted URL may have their data compromised or their browsers used to launch further attacks.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face legal penalties, reputational damage, and loss of customer trust due to unauthorized data exposure or access.

Mitigation Strategies

Update affected TanStack packages to the latest patched versions: @tanstack/start-server-core 1.169.39, @tanstack/react-start 1.168.60, @tanstack/solid-start 1.168.57, or @tanstack/vue-start 1.168.56. Remove any non-public fields from server-function requests and validate middleware state handling to prevent error path manipulation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102989. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart