{"id":"EUVD-2026-98849","enisaUuid":"c620961b-0f39-34d8-a96c-4f12745779cc","description":"TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an unauthenticated attacker can place non-public fields in a server-function request payload so that attacker-controlled middleware state reaches the error path and a response-shaped object is accepted as an HTTP response. A crafted server-function URL can therefore return attacker-controlled HTML from the application\u0027s origin; when a visitor opens the URL, the injected script can access same-origin data and issue requests with the visitor\u0027s authority. This issue is fixed in @tanstack/start-server-core 1.169.39, @tanstack/react-start 1.168.60, @tanstack/solid-start 1.168.57, and @tanstack/vue-start 1.168.56.","datePublished":"Oct 13, 2026, 4:13:13 PM","dateUpdated":"Oct 14, 2026, 3:20:08 PM","baseScore":9.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","references":"https://github.com/TanStack/router/security/advisories/GHSA-qx66-fv34-fjm8\nhttps://github.com/TanStack/router/pull/8573\nhttps://github.com/TanStack/router/commit/d521abd71c69f1ff010bb3def4d417cb5fa058cb\nhttps://github.com/TanStack/router/releases/tag/release-2026-09-30-1747\n","aliases":"CVE-2026-102989\nGHSA-qx66-fv34-fjm8\n","assigner":"GitHub_M","epss":0.54,"enisaIdProduct":[{"id":"198f8b68-6401-36f9-bb58-448b33dcdf88","product":{"name":"vue-start","vendor":{"name":"@tanstack"}},"product_version":"1.143.12, \u003c 1.168.56"},{"id":"83c79c1c-bbe9-3384-bb98-1e91a6734936","product":{"name":"react-start","vendor":{"name":"@tanstack"}},"product_version":"1.143.12, \u003c 1.168.60"},{"id":"96076f02-5c82-3711-a431-337f4a849cb0","product":{"name":"start-server-core","vendor":{"name":"@tanstack"}},"product_version":"1.143.12, \u003c 1.169.39"},{"id":"d374e6c2-5e04-3c90-af07-f5b2965396c6","product":{"name":"Router","vendor":{"name":"ASUS"}},"product_version":"\u003c release-2026-09-30-1747"},{"id":"fd32864e-0cbe-3b4a-b034-f496e082f960","product":{"name":"solid-start","vendor":{"name":"@tanstack"}},"product_version":"1.143.12, \u003c 1.168.57"}],"enisaIdVendor":[{"id":"011b508d-30cf-32e4-a8b1-d4ffe4668df3","vendor":{"name":"TanStack"}},{"id":"513edf67-a058-3478-977e-a28c7b4b81b7","vendor":{"name":"@tanstack"}}],"enisaIdVulnerability":[{"id":"75824efb-70e1-3829-beba-08b3b4c4ae33","vulnerability":{"id":"CVE-2026-102989","description":"TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an unauthenticated attacker can place non-public fields in a server-function request payload so that attacker-controlled middleware state reaches the error path and a response-shaped object is accepted as an HTTP response. A crafted server-function URL can therefore return attacker-controlled HTML from the application\u0027s origin; when a visitor opens the URL, the injected script can access same-origin data and issue requests with the visitor\u0027s authority. This issue is fixed in @tanstack/start-server-core 1.169.39, @tanstack/react-start 1.168.60, @tanstack/solid-start 1.168.57, and @tanstack/vue-start 1.168.56.","datePublished":"Oct 13, 2026, 4:13:13 PM","dateUpdated":"Oct 14, 2026, 3:20:08 PM","status":"PUBLISHED","baseScore":9.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","references":"https://github.com/TanStack/router/security/advisories/GHSA-qx66-fv34-fjm8\nhttps://github.com/TanStack/router/pull/8573\nhttps://github.com/TanStack/router/commit/d521abd71c69f1ff010bb3def4d417cb5fa058cb\nhttps://github.com/TanStack/router/releases/tag/release-2026-09-30-1747\n","enisa_id":"EUVD-2026-98849\n","assigner":"GitHub_M","epss":0.54,"dataProcessed":"Nov 6, 2026, 7:16:44 AM","vulnerabilityProduct":[{"id":"34972f01-406e-381e-b5be-02e4827d4f82","product":{"name":"vue-start","vendor":{"name":"@tanstack"}},"product_version":"1.143.12, \u003c 1.168.56"},{"id":"6d346dac-eb8f-3047-aa47-fa939ba8e45a","product":{"name":"Router","vendor":{"name":"ASUS"}},"product_version":"\u003c release-2026-09-30-1747"},{"id":"98abf776-a541-3165-9848-fca111723521","product":{"name":"react-start","vendor":{"name":"@tanstack"}},"product_version":"1.143.12, \u003c 1.168.60"},{"id":"f2d9f2c2-a97c-35a0-b603-0026c01e65af","product":{"name":"solid-start","vendor":{"name":"@tanstack"}},"product_version":"1.143.12, \u003c 1.168.57"},{"id":"ff549352-cd70-3913-9467-4a9562dd9227","product":{"name":"start-server-core","vendor":{"name":"@tanstack"}},"product_version":"1.143.12, \u003c 1.169.39"}],"vulnerabilityVendor":[{"id":"00ce7bcc-596e-36f1-a490-aa96b7eeccea","vendor":{"name":"TanStack"}},{"id":"6447bc7a-c3f4-3be2-b227-150c378870cd","vendor":{"name":"@tanstack"}}]}},{"id":"92e3a0a0-612a-347e-8112-c23dce87cc47","vulnerability":{"id":"GHSA-qx66-fv34-fjm8","description":"TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses","datePublished":"Oct 15, 2026, 8:22:20 PM","dateUpdated":"Oct 15, 2026, 8:22:21 PM","baseScore":0.0,"references":"https://github.com/TanStack/router/security/advisories/GHSA-qx66-fv34-fjm8\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-102989\nhttps://github.com/TanStack/router/pull/8573\nhttps://github.com/TanStack/router/commit/d521abd71c69f1ff010bb3def4d417cb5fa058cb\nhttps://github.com/TanStack/router\nhttps://github.com/TanStack/router/releases/tag/release-2026-09-30-1747\n","enisa_id":"EUVD-2026-98849\n","aliases":"GHSA-qx66-fv34-fjm8\nCVE-2026-102989\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:48 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}