Reflected XSS in TanStack Start Server-Functions

CVE-2026-102989 is a critical reflected cross-site scripting (XSS) vulnerability affecting TanStack Start framework applications. The issue stems from the server-function transport layer, which improperly allows request payload fields to influence internal middleware state rather than restricting input to defined public fields. An attacker can craft a malformed payload that forces an attacker-controlled result into the error path, which is then incorrectly processed by the response handler as an HTTP response. This allows the attacker to inject arbitrary HTML and execute JavaScript within the application's origin when a victim navigates to a crafted URL. Successful exploitation enables unauthorized access to same-origin data and the ability to perform requests on behalf of the victim.

Attack Chain

1. Attacker identifies a target application utilizing vulnerable versions of TanStack Start.
2. Attacker crafts a malicious URL targeting a server-function endpoint, typically under the /_serverFn/* path.
3. Attacker injects a malicious payload into the request fields that influences internal middleware state.
4. The application receives the request and fails to validate the payload against expected public input fields.
5. The server-function error path processes the malformed payload, leading to the creation of a response-shaped object containing attacker-supplied content.
6. The server transmits the malicious response back to the client.
7. The victim's browser interprets the malicious response, executing the injected JavaScript in the context of the application's origin.

Impact

The vulnerability allows unauthenticated attackers to perform reflected XSS attacks against any user who navigates to a crafted link. This provides the attacker the ability to steal sensitive user data, perform actions as the authenticated user, and bypass same-origin protections. All applications using affected versions of @tanstack/start-server-core, @tanstack/react-start, @tanstack/solid-start, and @tanstack/vue-start (version 1.143.12 and above) are exposed until patched.

Recommendation

1. Upgrade all affected packages immediately to the following patched versions: @tanstack/start-server-core@1.169.39, @tanstack/react-start@1.168.60, @tanstack/solid-start@1.168.57, and @tanstack/vue-start@1.168.56.
2. Implement a restrictive Content Security Policy (CSP) to limit the execution of unauthorized scripts if patching is delayed.
3. Deploy WAF rules to block requests to /_serverFn/* that lack the mandatory x-tsr-serverFn: true header.
4. Configure WAF rules to block requests directed at server-function endpoints that contain headers associated with browser navigations, such as Sec-Fetch-Mode: navigate or Accept: text/html.