Node.js Module TanStack Start 1.143.12 < 1.168.56 / 1.168.57 / 1.168.60 / 1.169.39 XSS (CVE-2026-102989)

The versions of the TanStack Start Node.js modules installed on the remote host are 1.143.12 or later, prior to their respective patched versions. They are, therefore, affected by a cross-site scripting vulnerability: - The server-function transport passes request payload fields into internal...

TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

Impact An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that...

GHSA-QX66-FV34-FJM8 TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

Impact An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that...

CVE-2026-102989 TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an...

CVE-2026-102989 TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an...

CVE-2026-102989: Improper Neutralization of Input During Web Page Generation

TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an...

TanStack Router cross-site scripting vulnerability

The TanStack Router contains a cross-site scripting vulnerability. This vulnerability arises because unauthenticated attackers can inject non-public fields into the payload of server-side function requests. As a result, the state of the middleware is altered, and objects with incorrect response...