Does Your TanStack Start App Let Attackers Inject Scripts via Server Functions?

TanStack Router contains a critical cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts into web applications. The flaw, identified as CVE-2026-102989, affects several npm packages within the TanStack Start ecosystem. According to the National Vulnerability Database, the issue permits attackers to return controlled HTML from the application’s origin, potentially hijacking user sessions and accessing same-origin data.

Root cause

The vulnerability stems from how server-function transport handles request payloads. According to the GitHub Security Advisory, the system can pass request payload fields into internal middleware state instead of restricting them to public input fields. A malformed payload can leave attacker-controlled results in the error path. Response handling then treats a response-shaped object as an HTTP response, allowing the injection of external code.

Attack path

An unauthenticated attacker crafts a specific URL targeting a server function in an affected TanStack Start application. When a visitor opens this link, the application returns attacker-controlled HTML from its own origin. The injected JavaScript can then access same-origin data available to that visitor and make requests with their authority, effectively compromising the user's session and data access.

Affected versions

The following npm packages are vulnerable in versions from 1.143.12 up to, but not including, their patched versions:

• @tanstack/start-server-core
• @tanstack/react-start
• @tanstack/solid-start
• @tanstack/vue-start

Mitigation

• Upgrade @tanstack/start-server-core to version 1.169.39 or later.
• Upgrade @tanstack/react-start to version 1.168.60 or later.
• Upgrade @tanstack/solid-start to version 1.168.57 or later.
• Upgrade @tanstack/vue-start to version 1.168.56 or later.

What it means for organisations

Security teams should immediately audit their dependency trees for vulnerable TanStack packages. Engineering leads need to coordinate rapid patching cycles to minimize exposure. Risk managers must assess the potential impact on user data integrity and session security. Communication plans should be prepared to inform stakeholders about the remediation efforts. Teams usually prioritize critical vulnerabilities in public-facing applications. Check whether your deployment pipelines automatically pull the latest secure versions.

What to do and how to stay safe: TanStack

• Scan your project dependencies for the affected TanStack packages.
• Apply the latest patch versions to your affected packages.
• Monitor server logs for unusual server-function requests.
• Implement temporary WAF rules to block suspicious requests if patching is delayed.

Step-by-step guide: Patch Testing Best Practices That Prevent Production Failures

General security guidance from the CloudSec Press newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-102989?

The CVSS score is 9.3, which is rated as critical.

Which packages are affected by this vulnerability?

@tanstack/start-server-core, @tanstack/react-start, @tanstack/solid-start, and @tanstack/vue-start are affected.

Is there a fix available for this issue?

Yes, patches are available for all affected packages.