TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web
TanStack · router
TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an unauthenticated attacker can place non-public fields in a server-function request payload so that attacker-controlled middleware state reaches the error path and a response-shaped object is accepted as an HTTP response. A crafted server-function URL can therefore return attacker-controlled HTML from the application's origin; when a visitor opens the URL, the injected script can access same-origin data and issue requests with the visitor's authority. This issue is fixed in @tanstack/start-server-core 1.169.39, @tanstack/react-start 1.168.60, @tanstack/solid-start 1.168.57, and @tanstack/vue-start 1.168.56.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Disclosed on 13 Oct 2026. No public exploit code or confirmed exploitation is recorded.
Patch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.
2 fixes in @tanstack/react-start over 5 months. The latest fix listed for @tanstack/react-start is 1.168.60.
Fixes in @tanstack/react-startnpm package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.
- 1.167.72CVE-2026-4532112 May 2026KEV
- 1.168.60CVE-2026-10298913 Oct 2026Latest listed
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Am I affected? What do I upgrade to?
From GitHub Security Advisories and OSV4 packages in 1 ecosystem. No single main package: each of these ships the affected code.
- npm@tanstack/start-server-coreAffected: 1.143.12 up to 1.169.39Upgrade to 1.169.39 or later
- npm@tanstack/react-startAffected: 1.143.12 up to 1.168.60Upgrade to 1.168.60 or later
- npm@tanstack/solid-startAffected: 1.143.12 up to 1.168.57Upgrade to 1.168.57 or later
- npm@tanstack/vue-startAffected: 1.143.12 up to 1.168.56Upgrade to 1.168.56 or later
What security researchers reported
Not named in any threat report yetAlso mentioned in 8 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Known_Cve | Oct 22, 2026 | Part 1/421 Oct 2026
- Known_Cve | Oct 21, 2026 | Part 2/420 Oct 2026
- Known_Cve | Oct 20, 2026 | Part 2/419 Oct 2026
- Known_Cve | Oct 19, 2026 | Part 2/418 Oct 2026
- Known_Cve | Oct 18, 2026 | Part 2/417 Oct 2026
- Known_Cve | Oct 17, 2026 | Part 2/416 Oct 2026
- 2 more on OTX