Skip to content
OpenAdvisories

Product · TanStack

router

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.3
    CVE-2026-102989

    TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

    TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 …

    TanStack react-start start-server-core solid-start npm