CVE-2026-102989
4 advisories.
npm/@tanstack/start-server-core CVE-2026-102989: critical 9.3
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
Action: Upgrade @tanstack/start-server-core to 1.169.39 or later.
npm i @tanstack/start-server-core@1.169.39Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.143.12 | 1.169.39 | - |
Fixed versions
| 1.169.39 |
Sources
- osv: GHSA-qx66-fv34-fjm8
- https://github.com/TanStack/router/security/advisories/GHSA-qx66-fv34-fjm8
- https://nvd.nist.gov/vuln/detail/CVE-2026-102989
- https://github.com/TanStack/router/pull/8573
- https://github.com/TanStack/router/commit/d521abd71c69f1ff010bb3def4d417cb5fa058cb
- https://github.com/TanStack/router
- https://github.com/TanStack/router/releases/tag/release-2026-09-30-1747
CVE-2026-102989 · published · modified · JSON
npm/@tanstack/react-start CVE-2026-102989: critical 9.3
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
Action: Upgrade @tanstack/react-start to 1.168.60 or later.
npm i @tanstack/react-start@1.168.60Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.143.12 | 1.168.60 | - |
Fixed versions
| 1.168.60 |
Sources
- osv: GHSA-qx66-fv34-fjm8#npm/@tanstack/react-start
- https://github.com/TanStack/router/security/advisories/GHSA-qx66-fv34-fjm8
- https://nvd.nist.gov/vuln/detail/CVE-2026-102989
- https://github.com/TanStack/router/pull/8573
- https://github.com/TanStack/router/commit/d521abd71c69f1ff010bb3def4d417cb5fa058cb
- https://github.com/TanStack/router
- https://github.com/TanStack/router/releases/tag/release-2026-09-30-1747
CVE-2026-102989 · published · modified · JSON
npm/@tanstack/solid-start CVE-2026-102989: critical 9.3
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
Action: Upgrade @tanstack/solid-start to 1.168.57 or later.
npm i @tanstack/solid-start@1.168.57Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.143.12 | 1.168.57 | - |
Fixed versions
| 1.168.57 |
Sources
- osv: GHSA-qx66-fv34-fjm8#npm/@tanstack/solid-start
- https://github.com/TanStack/router/security/advisories/GHSA-qx66-fv34-fjm8
- https://nvd.nist.gov/vuln/detail/CVE-2026-102989
- https://github.com/TanStack/router/pull/8573
- https://github.com/TanStack/router/commit/d521abd71c69f1ff010bb3def4d417cb5fa058cb
- https://github.com/TanStack/router
- https://github.com/TanStack/router/releases/tag/release-2026-09-30-1747
CVE-2026-102989 · published · modified · JSON
npm/@tanstack/vue-start CVE-2026-102989: critical 9.3
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
Action: Upgrade @tanstack/vue-start to 1.168.56 or later.
npm i @tanstack/vue-start@1.168.56Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.143.12 | 1.168.56 | - |
Fixed versions
| 1.168.56 |
Sources
- osv: GHSA-qx66-fv34-fjm8#npm/@tanstack/vue-start
- https://github.com/TanStack/router/security/advisories/GHSA-qx66-fv34-fjm8
- https://nvd.nist.gov/vuln/detail/CVE-2026-102989
- https://github.com/TanStack/router/pull/8573
- https://github.com/TanStack/router/commit/d521abd71c69f1ff010bb3def4d417cb5fa058cb
- https://github.com/TanStack/router
- https://github.com/TanStack/router/releases/tag/release-2026-09-30-1747
CVE-2026-102989 · published · modified · JSON