Node.js Module TanStack Start 1.143.12 < 1.168.56 / 1.168.57 / 1.168.60 / 1.169.39 XSS (CVE-2026-102989)

The versions of the TanStack Start Node.js modules installed on the remote host are 1.143.12 or later, prior to their respective patched versions. They are, therefore, affected by a cross-site scripting vulnerability: - The server-function transport passes request payload fields into internal...

@apimatic/cli (>=2.0.0-beta.1, <=2.0.0-beta.6), @bgub/fig-tanstack-start (>=0.1.0-alpha.1, <=1.0.0) +44 more potentially affected by CVE-2026-102989 via @tanstack/start-server-core (>=1.143.12, <=1.169.38)

@tanstack/start-server-core NPM version =1.143.12, =2.0.0-beta.1, =0.1.0-alpha.1, =1.0.0-rc.11, =2.0.0, =2.0.0, =0.1.1, =1.168.32-depup.0, =0.1.31-depup.0, =1.167.23-depup.0, =0.2.0, =0.1.77, =0.1.50, =0.1.43, =0.1.8, =0.2.0 and more Source cves: CVE-2026-102989 Source advisory:...

EUVD-2026-98849

TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses...

TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

Impact An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that...

@apimatic/cli (>=2.0.0-beta.1, <=2.0.0-beta.6), @bgub/fig-tanstack-start (>=0.1.0-alpha.1, <=1.0.0) +44 more potentially affected by CVE-2026-102989 via @tanstack/start-server-core (>=1.143.12, <=1.169.38)

@tanstack/start-server-core NPM version =1.143.12, =2.0.0-beta.1, =0.1.0-alpha.1, =1.0.0-rc.11, =2.0.0, =2.0.0, =0.1.1, =1.168.32-depup.0, =0.1.31-depup.0, =1.167.23-depup.0, =0.2.0, =0.1.77, =0.1.50, =0.1.43, =0.1.8, =0.2.0 and more Source cves: CVE-2026-102989 Source advisory: GHSA-QX66-FV34-FJ...

@apimatic/cli (>=2.0.0-beta.1, <=2.0.0-beta.6), @bgub/fig-tanstack-start (>=0.1.0-alpha.1, <=1.0.0) +44 more potentially affected by CVE-2026-102989 via @tanstack/start-server-core (>=1.143.12, <=1.169.38)

@tanstack/start-server-core NPM version =1.143.12, =2.0.0-beta.1, =0.1.0-alpha.1, =1.0.0-rc.11, =2.0.0, =2.0.0, =0.1.1, =1.168.32-depup.0, =0.1.31-depup.0, =1.167.23-depup.0, =0.2.0, =0.1.77, =0.1.50, =0.1.43, =0.1.8, =0.2.0 and more Source cves: CVE-2026-102989 Source advisory:...

GHSA-QX66-FV34-FJM8 TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

Impact An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that...

CVE-2026-102989

TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an...

CVE-2026-102989 TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an...

@apimatic/cli (>=2.0.0-beta.1, <=2.0.0-beta.6), @bgub/fig-tanstack-start (>=0.1.0-alpha.1, <=1.0.0) +37 more potentially affected by CVE-2026-102989 via @tanstack/start-server-core (>=1.169.0, <=1.169.38)

@tanstack/start-server-core NPM version =1.169.0, =2.0.0-beta.1, =0.1.0-alpha.1, =1.0.0-rc.11, =2.0.0, =2.0.0, =1.168.32-depup.0, =0.1.31-depup.0, =1.167.23-depup.0, =0.2.2, =0.1.77, =0.1.50, =0.1.43, =0.1.8, =0.5.0, =0.11.0 and more Source cves: CVE-2026-102989 Source advisory: MEND:CVE-2026-102...

CVE-2026-102989

TanStack Router is vulnerable to an unauthenticated reflected XSS in its server-function responses. The root cause involves an attacker placing non-public fields in a server-function request payload, causing attacker-controlled middleware state to reach the error path. This allows a crafted URL t...

CVE-2026-102989

TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an...

PT-2026-103655

Name of the Vulnerable Software and Affected Versions @tanstack/react-start versions 1.143.12 through 1.168.59 Description A critical reflected Cross-Site Scripting XSS issue exists in TanStack Start server-function responses. Reflected XSS occurs when an application includes untrusted data in a...

@ardeora/start-devtools (>=1.0.0, <=1.0.1), @carvajalconsultants/headstart (>=1.0.0, <=1.0.2) +32 more potentially affected by unknown CVE via @tanstack/start-server-core (>=1.121.0-alpha.28, <=1.167.29)

@tanstack/start-server-core NPM version =1.121.0-alpha.28, =1.0.0, =1.0.0, =0.0.14, =1.0.0, =0.3.0, =0.3.0, =1.20.3-alpha.1, =1.111.10, =1.121.23, =0.0.1, =1.121.0-alpha.28, =1.20.3-alpha.1, =1.114.29, =1.121.23, =1.131.50 and more Source cves: unknown CVE Source advisory: OSV:GHSA-9M65-766C-R333...

@ardeora/start-devtools (>=1.0.0, <=1.0.1), @carvajalconsultants/headstart (>=1.0.0, <=1.0.2) +32 more potentially affected by unknown CVE via @tanstack/start-server-core (>=1.121.0-alpha.28, <=1.167.29)

@tanstack/start-server-core NPM version =1.121.0-alpha.28, =1.0.0, =1.0.0, =0.0.14, =1.0.0, =0.3.0, =0.3.0, =1.20.3-alpha.1, =1.111.10, =1.121.23, =0.0.1, =1.121.0-alpha.28, =1.20.3-alpha.1, =1.114.29, =1.121.23, =1.131.50 and more Source cves: unknown CVE Source advisory:...

@ardeora/start-devtools (>=1.0.0, <=1.0.1), @carvajalconsultants/headstart (>=1.0.0, <=1.0.2) +32 more potentially affected by unknown CVE via @tanstack/start-server-core (>=1.121.0-alpha.28, <=1.167.29)

@tanstack/start-server-core NPM version =1.121.0-alpha.28, =1.0.0, =1.0.0, =0.0.14, =1.0.0, =0.3.0, =0.3.0, =1.20.3-alpha.1, =1.111.10, =1.121.23, =0.0.1, =1.121.0-alpha.28, =1.20.3-alpha.1, =1.114.29, =1.121.23, =1.131.50 and more Source cves: unknown CVE Source advisory: GHSA-9M65-766C-R333...

PT-2026-42958

Summary A type-confusion bug in seroval ≤ 1.5.2 upstream advisory allowed a crafted JSON body sent to one TanStack Start server function to trigger invocation of a different client-referenced server function as a side effect of deserializing the request payload. This is not an authentication bypa...

Malware in @tanstack/start-client-core

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-3488 Malicious code in @tanstack/start-fn-stubs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e25d3624c39cfe3dae76a5630525e72d3f0fe2f8eb1bbb44a0ff17c3a39d4fe2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @tanstack/start-fn-stubs

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...