diff --git a/src/blog/tanstack-start-security-update-cve-2026-102989.md b/src/blog/tanstack-start-security-update-cve-2026-102989.md
new file mode 100644
index 000000000..e97f5999a
--- /dev/null
+++ b/src/blog/tanstack-start-security-update-cve-2026-102989.md
@@ -0,0 +1,29 @@
+---
+title: 'TanStack Start security update: CVE-2026-102989'
+published: 2026-09-30
+excerpt: A fix for a reflected XSS vulnerability in TanStack Start is available on npm. Upgrade and redeploy affected applications.
+authors:
+  - Tanner Linsley
+library: start
+---
+
+We've released a fix for **CVE-2026-102989**, a critical reflected cross-site scripting (XSS) vulnerability in TanStack Start's server-function response handling. The patched packages are available on npm now, and we recommend upgrading and redeploying affected applications immediately.
+
+An unauthenticated attacker could craft a server-function URL that returns attacker-controlled HTML from an affected application's origin. If a user opens that link, the attacker's JavaScript could run with that user's access to the application. The fix restricts client-supplied input and validates responses at the server boundary.
+
+## Upgrade to a patched version
+
+Versions from `1.143.12` up to, but excluding, the corresponding patched version below are affected.
+
+| Package                       | First patched version |
+| ----------------------------- | --------------------- |
+| `@tanstack/react-start`       | `1.168.60`            |
+| `@tanstack/solid-start`       | `1.168.57`            |
+| `@tanstack/vue-start`         | `1.168.56`            |
+| `@tanstack/start-server-core` | `1.169.39`            |
+
+Update your Start dependencies and lockfile, confirm that the resolved `@tanstack/start-server-core` version is `1.169.39` or later, then rebuild and redeploy. Updating a local installation alone doesn't patch an already deployed application. Edge mitigations can help while upgrading, but they aren't a replacement for the fix.
+
+We privately briefed hosting providers, distributors, and affected partners ahead of this release so they could prepare. Thank you to [Lovable](https://lovable.dev) for helping us discover the issue and working with us to fix it.
+
+See the [GitHub security advisory](https://github.com/TanStack/router/security/advisories/GHSA-qx66-fv34-fjm8) for the affected ranges, severity, and mitigation details.