A crafted link to a TanStack Start server function could run an attacker's script in the app
TanStack's repository advisory GHSA-qx66-fv34-fjm8 was published September 30, 2026. CVE-2026-102989 was published October 13, 2026. It says a crafted server-function link can make an affected TanStack Start app return attacker-controlled HTML from its own origin, and that script can act with the visitor's access. The record rates it Critical, CVSS 3.1 score 9.3. The visitor has to open the link.
What was reported
CVE-2026-102989 was published October 13, 2026. The NVD record says that from 1.143.12 until the patched versions, an unauthenticated attacker can place non-public fields in a server-function request payload. Attacker-controlled middleware state then reaches the error path, and a response-shaped object is accepted as an HTTP response. A crafted server-function URL can return attacker-controlled HTML from the application's own origin. When a visitor opens that URL, the script can access same-origin data and issue requests with the visitor's authority.
The record's affected ranges are @tanstack/start-server-core 1.143.12 up to but not including 1.169.39, @tanstack/react-start 1.143.12 up to but not including 1.168.60, @tanstack/solid-start 1.143.12 up to but not including 1.168.57, and @tanstack/vue-start 1.143.12 up to but not including 1.168.56. It says the fixes are 1.169.39, 1.168.60, 1.168.57, and 1.168.56. TanStack's repository advisory GHSA-qx66-fv34-fjm8 was published September 30, 2026. NVD references that advisory and lists the TanStack router product as affected before release-2026-09-30-1747. It assigns CWE-79 and CVSS 3.1 score 9.3, severity Critical, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. The visitor has to open the link. CISA's SSVC entry on the record, dated October 14, 2026, says exploitation none, automatable no, and technical impact total.
How to prevent it
Upgrade @tanstack/react-start to 1.168.60 or later, @tanstack/solid-start to 1.168.57 or later, and @tanstack/vue-start to 1.168.56 or later, and check that @tanstack/start-server-core resolves to 1.169.39 or later, then rebuild and redeploy. The record says the script can read same-origin data and send requests with the visitor's authority.
Sources
The weekly fix
The weekly fix: 3 real security mistakes in vibe-coded apps and how to fix them, every Tuesday.
The security issues hitting Supabase, Vercel, Next.js, and Stripe apps
One short email a week, with the fix.