From e03990f29ae909e49c332bd21fc0f5fbd6b4bafc Mon Sep 17 00:00:00 2001 From: Tanner Linsley Date: Wed, 30 Sep 2026 12:09:25 -0600 Subject: [PATCH 1/2] docs: publish TanStack Start security update --- ...k-start-security-update-cve-2026-102989.md | 29 +++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 src/blog/tanstack-start-security-update-cve-2026-102989.md diff --git a/src/blog/tanstack-start-security-update-cve-2026-102989.md b/src/blog/tanstack-start-security-update-cve-2026-102989.md new file mode 100644 index 000000000..dcbb8326c --- /dev/null +++ b/src/blog/tanstack-start-security-update-cve-2026-102989.md @@ -0,0 +1,29 @@ +--- +title: 'TanStack Start security update: CVE-2026-102989' +published: 2026-09-30 +excerpt: A fix for a reflected XSS vulnerability in TanStack Start is available on npm. Upgrade and redeploy affected applications. +authors: + - Tanner Linsley +library: start +--- + +We've released a fix for **CVE-2026-102989**, a critical reflected cross-site scripting (XSS) vulnerability in TanStack Start's server-function response handling. The patched packages are available on npm now, and we recommend upgrading and redeploying affected applications immediately. + +An unauthenticated attacker could craft a server-function URL that returns attacker-controlled HTML from an affected application's origin. If a user opens that link, the attacker's JavaScript could run with that user's access to the application. The fix restricts client-supplied input and validates responses at the server boundary. + +## Upgrade to a patched version + +Versions from `1.143.12` up to, but excluding, the corresponding patched version below are affected. + +| Package | First patched version | +| --- | --- | +| `@tanstack/react-start` | `1.168.60` | +| `@tanstack/solid-start` | `1.168.57` | +| `@tanstack/vue-start` | `1.168.56` | +| `@tanstack/start-server-core` | `1.169.39` | + +Update your Start dependencies and lockfile, confirm that the resolved `@tanstack/start-server-core` version is `1.169.39` or later, then rebuild and redeploy. Updating a local installation alone doesn't patch an already deployed application. Edge mitigations can help while upgrading, but they aren't a replacement for the fix. + +We privately briefed hosting providers, distributors, and affected partners ahead of this release so they could prepare. Thank you to [Lovable](https://lovable.dev) for helping us discover the issue and working with us to fix it. + +See the [GitHub security advisory](https://github.com/TanStack/router/security/advisories/GHSA-qx66-fv34-fjm8) for the affected ranges, severity, and mitigation details. From a90c06a0659191b899bf0bf61ea90a34a808e3d6 Mon Sep 17 00:00:00 2001 From: "autofix-ci[bot]" <114827586+autofix-ci[bot]@users.noreply.github.com> Date: Wed, 30 Sep 2026 18:10:21 +0000 Subject: [PATCH 2/2] ci: apply automated fixes --- ...tanstack-start-security-update-cve-2026-102989.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/blog/tanstack-start-security-update-cve-2026-102989.md b/src/blog/tanstack-start-security-update-cve-2026-102989.md index dcbb8326c..e97f5999a 100644 --- a/src/blog/tanstack-start-security-update-cve-2026-102989.md +++ b/src/blog/tanstack-start-security-update-cve-2026-102989.md @@ -15,12 +15,12 @@ An unauthenticated attacker could craft a server-function URL that returns attac Versions from `1.143.12` up to, but excluding, the corresponding patched version below are affected. -| Package | First patched version | -| --- | --- | -| `@tanstack/react-start` | `1.168.60` | -| `@tanstack/solid-start` | `1.168.57` | -| `@tanstack/vue-start` | `1.168.56` | -| `@tanstack/start-server-core` | `1.169.39` | +| Package | First patched version | +| ----------------------------- | --------------------- | +| `@tanstack/react-start` | `1.168.60` | +| `@tanstack/solid-start` | `1.168.57` | +| `@tanstack/vue-start` | `1.168.56` | +| `@tanstack/start-server-core` | `1.169.39` | Update your Start dependencies and lockfile, confirm that the resolved `@tanstack/start-server-core` version is `1.169.39` or later, then rebuild and redeploy. Updating a local installation alone doesn't patch an already deployed application. Edge mitigations can help while upgrading, but they aren't a replacement for the fix.