TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

What it is: TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses. An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there.

Who is affected: - @tanstack/start-server-core (JavaScript, via npm), versions >= 1.143.12, < 1.169.39 - @tanstack/react-start (JavaScript, via npm), versions >= 1.143.12, < 1.168.60 - @tanstack/solid-start (JavaScript, via npm), versions >= 1.143.12, < 1.168.57 - @tanstack/vue-start (JavaScript, via npm), versions >= 1.143.12, < 1.168.56

Is it being exploited: GitHub's advisory does not say it is being exploited. GitHub rates it critical (CVSS 3.1 score 9.3). It was published on 15 October 2026.

What to do: - Update @tanstack/start-server-core to 1.169.39 or later. - Update @tanstack/react-start to 1.168.60 or later. - Update @tanstack/solid-start to 1.168.57 or later. - Update @tanstack/vue-start to 1.168.56 or later. - Check your lock file (package-lock.json, yarn.lock or pnpm-lock.yaml) to see which version you actually run, including as a dependency of something else.