---
id: 2026-10-tanstack-start-server-function-reflected-xss-lovable-cve-2026-102989
title: "TanStack Start: unauthenticated reflected XSS in server-function responses, found by Lovable (CVE-2026-102989, 9.3); fixed 1.168.60 and 1.169.39"
date_disclosed: 2026-09-30
last_updated: 2026-10-16
severity: critical
status: patched
ecosystems: [npm, web-frameworks, lovable, netlify]
tools_affected: ["@tanstack/start-server-core 1.143.12 through 1.169.38 → 1.169.39", "@tanstack/react-start 1.143.12 through 1.168.59 → 1.168.60", "@tanstack/solid-start 1.143.12 through 1.168.56 → 1.168.57", "@tanstack/vue-start 1.143.12 through 1.168.55 → 1.168.56", "apps generated on Lovable, which says TanStack Start is a framework its apps run on", "any deployed build on an affected version until it is rebuilt and redeployed"]
tags: [cve, xss, reflected-xss, server-functions, tanstack-start, lovable, netlify, web-framework, vendor-ghsa, database-backfill, redeploy-required, patched]
---

## TL;DR
TanStack Start, the full-stack framework under Lovable-generated apps, let a server-function request carry fields that were not public input, so attacker-controlled middleware state reached the error path and a response-shaped object was sent as the HTTP response: a crafted server-function URL returns attacker HTML from the application's own origin, and a visitor who opens it runs the attacker's script with their session (CVE-2026-102989, GitHub CNA, CVSS 3.1 9.3, CWE-79). Fixed on 2026-09-30 in `@tanstack/start-server-core` 1.169.39, `react-start` 1.168.60, `solid-start` 1.168.57 and `vue-start` 1.168.56 (npm `time` 2026-09-30T17:48Z). Lovable's security team found it on 2026-09-14, reported it the same day, put firewall rules in front of hosted apps while the fix was prepared, and upgrades affected projects on their next edit; an app hosted anywhere else is fixed only when it is upgraded, rebuilt and redeployed, because a local `npm update` changes nothing in a running deployment. The CVE record is dated 2026-10-13 and the reviewed-critical npm listing 2026-10-15; the vendor advisory is 2026-09-30, and this file dates by the vendor.

## What happened

TanStack published GHSA-qx66-fv34-fjm8 on 2026-09-30 with the fix releases. The mechanism, in the advisory's terms: the server-function transport passed request payload fields into internal middleware state instead of limiting them to public input fields, a malformed payload left an attacker-controlled result in the error path, and response handling accepted that response-shaped object as the HTTP response. The fix "restricts client-supplied input and validates responses at the server boundary." The CNA record (GitHub, published 2026-10-13) lists the four packages with the ranges in the frontmatter and CVSS 3.1 9.3 (`AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N`), plus a repository range "< release-2026-09-30-1747", which is the release tag; the fix is pull request #8573. npm's `time` field puts `@tanstack/start-server-core@1.169.39` at 2026-09-30T17:48:11Z and `@tanstack/react-start@1.168.60` at 17:48:34Z; the previous releases of both lines were 2026-09-27. The two packages each had about 11.6 million downloads in the week of 2026-10-06 to 10-12 (`api.npmjs.org`).

Lovable's post, also 2026-09-30, says a researcher on its security team found the flaw on 2026-09-14 "while examining software libraries that power Lovable apps," that Lovable reported it to TanStack that day and coordinated the disclosure, that it deployed firewall rules against exploitation attempts on hosted apps while the upstream fix was prepared and kept them in place, and that it has found no evidence of exploitation in the logs it reviewed. It says using TanStack Start alone did not make every app exploitable, without saying which were; affected projects are updated automatically the next time the user makes a change, can be updated at once from the project's Security page at no credit cost, and owners of affected projects will be emailed. Apps hosted elsewhere are outside those protections. TanStack's post thanks Lovable for the discovery and says it "privately briefed hosting providers, distributors, and affected partners ahead of this release." Netlify's changelog entry of the same day adds the operational detail that matters for everyone: "Updating a local installation alone doesn't patch an already deployed application," and publicly reachable deploy previews and branch deploys stay vulnerable until they are deleted.

The advisory's interim mitigations, for an app that cannot upgrade today: edge or WAF rules that block requests to the server-function path (usually `/_serverFn/*`) that lack the `x-tsr-serverFn: true` header or look like a browser document navigation, and a restrictive Content Security Policy on server-function responses. The advisory says these are not a complete fix and that the header is client-controlled, so it is a filter, not authentication.

This is the second TanStack entry in this corpus and a different incident from the first: [the 2026-05 Mini Shai-Hulud wave](2026-05-tanstack-mini-shai-hulud.md) was a registry compromise of TanStack packages; this is a vulnerability in the framework's own code, found by the vibe-coding platform that ships it.

## Am I affected?

```bash
# Versions in the checkout
npm ls @tanstack/start-server-core @tanstack/react-start @tanstack/solid-start @tanstack/vue-start 2>/dev/null
# start-server-core below 1.169.39, react-start below 1.168.60, solid-start below 1.168.57, vue-start below 1.168.56 = affected
# A deployment keeps the version it was built with; check the lockfile the deploy was built from, not only the working tree
grep -A1 '"node_modules/@tanstack/start-server-core"' package-lock.json 2>/dev/null | grep version
```

Affected if any of the four packages is in its range in a build that is deployed. Lovable says not every app on the framework was exploitable but does not publish the distinguishing condition, so treat the version as the test. On Lovable hosting, the project's Security page shows whether the update has been applied.

## If you are affected

Upgrade the Start packages and the lockfile, confirm `@tanstack/start-server-core` resolves to 1.169.39 or later, rebuild and redeploy; then delete deploy previews and branch deploys built from the old version. On Lovable, apply the update from the Security page or make any edit, and read the email if your project was named. If your edge logs show requests to the server-function path returning HTML, treat the sessions of visitors who opened such links as exposed, invalidate them, and follow [if-your-webapp-was-compromised.md](../playbooks/if-your-webapp-was-compromised.md).

## Prevention

- Treat the framework under a generated app as a dependency you own: pin it, watch its advisory tab, and redeploy on a security release even when your own code did not change. See [auditing-a-vibe-coded-repo.md](../playbooks/auditing-a-vibe-coded-repo.md).
- A platform firewall rule protects the platform's hosting; the same app exported to another host carries the bug with it.

## Sources
- [GHSA-qx66-fv34-fjm8, TanStack vendor tab](https://github.com/TanStack/router/security/advisories/GHSA-qx66-fv34-fjm8) — 2026-09-30, mechanism, ranges, mitigations, "Lovable helped discover and report."
- [CVE-2026-102989, CVE Services record (GitHub CNA)](https://cveawg.mitre.org/api/cve/CVE-2026-102989) — published 2026-10-13, the four package ranges, the release tag, PR #8573.
- [TanStack blog, security update](https://tanstack.com/blog/tanstack-start-security-update-cve-2026-102989) — 2026-09-30, Tanner Linsley; the upgrade-and-redeploy instruction, the private briefing of hosting providers.
- [Lovable blog, how Lovable protects your app](https://lovable.dev/en/blog/how-lovable-protects-your-app-from-a-tanstack-start-vulnerability) — 2026-09-30; discovery 2026-09-14, firewall rules, auto-update on next edit, Security page, no exploitation found in reviewed logs.
- [Netlify changelog, 2026-09-30](https://www.netlify.com/changelog/2026-09-30-tanstack-start-security-vulnerability.md) — ranges, "Updating a local installation alone doesn't patch an already deployed application," deploy previews.
- [GitHub Advisory Database, reviewed critical npm](https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm+severity%3Acritical) — the 2026-10-15 listing row that surfaced the record.
- npm registry `time` for `@tanstack/react-start` and `@tanstack/start-server-core`, and `api.npmjs.org/downloads/point/last-week/` for both, fetched 2026-10-16.