npm/@tanstack/start-server-core CVE-2026-102989: critical 9.3

TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

Action: Upgrade @tanstack/start-server-core to 1.169.39 or later.

npm i @tanstack/start-server-core@1.169.39

Affected

Fixed versions

Sources

• osv: GHSA-qx66-fv34-fjm8
• https://github.com/TanStack/router/security/advisories/GHSA-qx66-fv34-fjm8
• https://nvd.nist.gov/vuln/detail/CVE-2026-102989
• https://github.com/TanStack/router/pull/8573
• https://github.com/TanStack/router/commit/d521abd71c69f1ff010bb3def4d417cb5fa058cb
• https://github.com/TanStack/router
• https://github.com/TanStack/router/releases/tag/release-2026-09-30-1747

CVE-2026-102989 · published 2026-10-15T20:22:20Z · modified 2026-10-15T20:30:04.544571974Z · JSON