TanStack Start XSS (CVE-2026-102989): check your @tanstack/*-start version

The fix

This is a version check only. If your stack uses TanStack Start, check the package version and upgrade to a patched release. Do not leave an affected version running.

Versions and patches come from the GitHub Security Advisory (GHSA-qx66-fv34-fjm8 / CVE-2026-102989). The TanStack Router release that ships @tanstack/react-start@1.168.60 is release-2026-09-30-1747.

# Example for a React Start app — pick the line that matches your package manager
npm ls @tanstack/react-start
npm install @tanstack/react-start@1.168.60
# Also bump start-server-core (and solid-start / vue-start if you use those) to the patched versions above.

Redeploy after the upgrade. The advisory’s temporary mitigations (WAF rules, CSP) are “not a complete fix”; upgrading is the fix (GHSA-qx66-fv34-fjm8).

Why it matters

The advisory rates this critical (CVSS 9.3). An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker’s JavaScript there, with access to same-origin data available to that visitor (GHSA-qx66-fv34-fjm8).

Cause (summary from the advisory): server-function transport could pass request payload fields into internal middleware state; a malformed payload could leave an attacker-controlled result on the error path, and response handling could treat a response-shaped object as an HTTP response. The fix limits client-supplied input to public fields and validates responses at the server boundary (GHSA-qx66-fv34-fjm8).

If your app does not use TanStack Start (@tanstack/react-start, solid-start, vue-start, or start-server-core), this advisory does not apply to that stack.

What not to do

• Don’t ignore the advisory because you “only use the framework through a builder.” If the dependency is in your lockfile, check it.
• Don’t rely only on edge/WAF or CSP workarounds; the advisory says those are incomplete (GHSA-qx66-fv34-fjm8).
• Don’t put secret or service_role keys in client code while you upgrade — unrelated, but the same standing rule applies.

AI prompt

Check whether this project depends on @tanstack/react-start, @tanstack/solid-start,
@tanstack/vue-start, or @tanstack/start-server-core. Report the installed versions
from the lockfile. If any are >= 1.143.12 and below the patched versions
(react-start 1.168.60, solid-start 1.168.57, vue-start 1.168.56, start-server-core 1.169.39),
propose the minimum upgrade and show the package.json / lockfile diff.
Do not change unrelated dependencies. Show the plan first and wait for my OK.

How to verify

1. Run npm ls @tanstack/react-start (or the solid/vue/server-core package you use) and confirm the version is at or above the patched release.
2. Confirm the lockfile updated and the app still builds.
3. Redeploy, then smoke-test sign-in and a main server function with two accounts (user A’s data stays private to A).

Related

Pre-launch checklist · Prompt pack · Judge free scanners

Your turn

Was TanStack Start a direct dependency you chose, or did it arrive through a scaffold? Tell us which check you ran first (npm ls vs the lockfile). We’ll lead with that.