TanStack Start XSS: Which Version Is Patched?

CVE-2026-102989 is a critical reflected XSS in TanStack Start's server-function response handling, published by TanStack on 30 September 2026, that lets a crafted server-function URL return attacker-controlled HTML from your origin. It is fixed in @tanstack/react-start 1.168.60, solid-start 1.168.57, vue-start 1.168.56 and start-server-core 1.169.39, and you are only safe once production is redeployed on those versions.

Related posts on ShopperCove:

• 01shoppercove.comNext.js 16 App Router Production Checklist (2026)
• 02shoppercove.comBuild an AI Chat UI with Next.js & shadcn (2026)
• 03shoppercove.comLily in CI: Fuzz-Based Backdoor Detection
• 04shoppercove.comCosign + SBOM in CI
• 05shoppercove.comAfter xz: Practical Supply-Chain Checklist
• 06shoppercove.comSetting up AI Coworkers with OpenBot
• 07shoppercove.comOpenTelemetry + Prometheus + Grafana
• 08shoppercove.comGrow Site Traffic in the AI Search Era (2026)

What went wrong (plain English)

An unauthenticated attacker could craft a server-function URL that returns attacker-controlled HTML from your application’s origin. If a user opens that link, the attacker’s JavaScript can run with that user’s access to your app.

TanStack’s fix restricts client-supplied input and validates responses at the server boundary. Hosting-edge rules may buy time; they are not a substitute for upgrading and redeploying.

Primary sources (read these, do not rely on secondary summaries alone):

• TanStack blog advisory
• Appwrite’s operator notes for Sites deployments: what to do on Appwrite

ShopperCove has not reproduced the exploit. This post is an operator checklist from public vendor advisories only—no PoC, no attack steps.

Who is affected

TanStack lists versions from 1.143.12 up to (but excluding) each patched line below as affected. Confirm what your lockfile resolves—not just what package.json asks for.

Package	First patched version
@tanstack/react-start	1.168.60
@tanstack/solid-start	1.168.57
@tanstack/vue-start	1.168.56
@tanstack/start-server-core	1.169.39

After upgrade, confirm @tanstack/start-server-core resolves to 1.169.39 or later.

Patch checklist (do this today)

1. Inventory — search the monorepo for @tanstack/react-start, @tanstack/solid-start, @tanstack/vue-start, and @tanstack/start-server-core.
2. Upgrade — bump to the patched versions for your framework line; refresh the lockfile.
3. Verify resolve — open the lockfile (or npm ls @tanstack/start-server-core) and confirm ≥ 1.169.39.
4. Rebuild + redeploy — a local node_modules bump without a new production deploy leaves the live app vulnerable.
5. Smoke the app — login, one write path, and any server-function heavy screens. If a host added temporary WAF rules (for example Appwrite’s edge header checks), expect some server-function calls to fail until the patched build is live—then retest.
6. Record — note the advisory id (CVE-2026-102989), the deploy SHA, and who signed off. Pair this habit with your usual supply-chain hygiene (after xz checklist, Cosign + SBOM).

Edge mitigations vs the real fix

Some hosts block known request patterns (for example requiring TanStack’s client header on server-function calls). That reduces exposure while you ship. TanStack is explicit: edge mitigations help while upgrading; they are not a replacement for the fix. Your site is only fixed when the patched packages are what production actually runs.

Adjacent Next.js note (different CVE)

If you also run Next.js 16.2–16.3.5 with Node.js ImageResponse from next/og and pass user-controlled values into SVG markup, review Vercel’s separate September 2026 update (patched at Next.js 16.3.6 for that RCE path). It is unrelated to TanStack Start—do not conflate the two—but many frontend shops run both stacks. See our Next.js 16 App Router checklist for production hygiene after you patch.

Printable operator checklist

1. Confirm Start packages in the lockfile
2. Upgrade to the patched versions in the table above
3. Assert start-server-core ≥ 1.169.39
4. Redeploy production (not just local install)
5. Smoke auth + server-function paths
6. File the CVE + deploy SHA in your change log
7. Keep CI signing/SBOM habits for the next advisory

No affiliate links on this post—security patching is not a product pitch. Ship the upgrade, then get back to product work

FAQ

What is CVE-2026-102989?

A reflected cross-site scripting bug in TanStack Start server functions. An unauthenticated attacker could craft a server-function URL that returns their HTML from your app's origin, so their JavaScript runs with the victim's access.

Which versions are affected?

TanStack lists versions from 1.143.12 up to (but not including) the patched lines: react-start 1.168.60, solid-start 1.168.57, vue-start 1.168.56 and start-server-core 1.169.39.

Is a WAF or edge rule enough?

No. TanStack says edge mitigations help while you upgrade but do not replace the fix. Confirm start-server-core resolves to 1.169.39 or later in the lockfile, then redeploy.

Related reading: Next.js 16.3.8 security release: SSRF, cache, and OG routes (and the earlier next/og RCE); After xz: A Practical Supply-Chain Checklist for Solo and Small Teams​