npm/@tanstack/react-start CVE-2026-102989: critical 9.3
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
Action: Upgrade @tanstack/react-start to 1.168.60 or later.
npm i @tanstack/react-start@1.168.60Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.143.12 | 1.168.60 | - |
Fixed versions
| 1.168.60 |
Sources
- osv: GHSA-qx66-fv34-fjm8#npm/@tanstack/react-start
- https://github.com/TanStack/router/security/advisories/GHSA-qx66-fv34-fjm8
- https://nvd.nist.gov/vuln/detail/CVE-2026-102989
- https://github.com/TanStack/router/pull/8573
- https://github.com/TanStack/router/commit/d521abd71c69f1ff010bb3def4d417cb5fa058cb
- https://github.com/TanStack/router
- https://github.com/TanStack/router/releases/tag/release-2026-09-30-1747
CVE-2026-102989 · published · modified · JSON