CVE-2026-102989Published

TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

Exact source revision recorded 23 Oct 2026 15:48:27 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

cve-program · CVE-2026-102989

Published

router

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "TanStack",
                    "product": "router",
                    "versions": [
                        {
                            "version": "< release-2026-09-30-1747",
                            "status": "affected"
                        }
                    ]
                }

react-start

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "@tanstack",
                    "product": "react-start",
                    "versions": [
                        {
                            "version": ">= 1.143.12, < 1.168.60",
                            "status": "affected"
                        }
                    ]
                }

solid-start

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "@tanstack",
                    "product": "solid-start",
                    "versions": [
                        {
                            "version": ">= 1.143.12, < 1.168.57",
                            "status": "affected"
                        }
                    ]
                }

start-server-core

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "@tanstack",
                    "product": "start-server-core",
                    "versions": [
                        {
                            "version": ">= 1.143.12, < 1.169.39",
                            "status": "affected"
                        }
                    ]
                }

vue-start

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "@tanstack",
                    "product": "vue-start",
                    "versions": [
                        {
                            "version": ">= 1.143.12, < 1.168.56",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON