@tanstack router vulnerabilities

Latest @tanstack router CVEs

Newest publication first

1. CVE-2026-102989 TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

   Published 2026-10-13

   Critical·CVSS 9.3

   TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-sta...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.