Repository navigation
fix(deps): update dependency @tanstack/react-start to v1.168.60 [security] - #2082
Merged
renovate[bot] merged 2 commits intoOct 16, 2026
Merged
Conversation
|
github-actions
Bot
added
example
renovate
Bot
deleted the
renovate/npm-tanstack-react-start-vulnerability
branch
October 16, 2026 00:49
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.168.49→1.168.60TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
CVE-2026-102989 / GHSA-qx66-fv34-fjm8
More information
Details
Impact
An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that visitor and make requests with their authority.
Cause
The server-function transport can pass request payload fields into internal middleware state instead of limiting them to public input fields. A malformed payload can leave an attacker-controlled result in the error path. Response handling can then treat a response-shaped object as an HTTP response.
Affected versions
Published versions of
@tanstack/start-server-core,@tanstack/react-start,@tanstack/solid-start, and@tanstack/vue-startfrom1.143.12up to, but not including, their respective patched versions are affected. The patched versions are@tanstack/[email protected],@tanstack/[email protected],@tanstack/[email protected], and@tanstack/[email protected].Fix
The fix limits client-supplied server-function input to public fields and validates responses at the server boundary. Upgrade to the corresponding patched package version.
Temporary mitigations
For the configured server-function path, usually
/_serverFn/*, an edge or WAF rule can consider blocking requests without the literalx-tsr-serverFn: trueheader and browser document navigations such asSec-Fetch-Mode: navigateorAccept: text/html. A restrictive Content Security Policy on server-function responses can provide another browser-side restriction. These are mitigation suggestions, not a complete fix. The header is client-controlled and is not authentication. Test rules against legitimate GET and POST server functions and use a matching version-specific backport where possible.Credits
Lovable helped us discover and report this issue. We thank them for their help.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
CVE-2026-102989 / GHSA-qx66-fv34-fjm8
More information
Details
Impact
An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that visitor and make requests with their authority.
Cause
The server-function transport can pass request payload fields into internal middleware state instead of limiting them to public input fields. A malformed payload can leave an attacker-controlled result in the error path. Response handling can then treat a response-shaped object as an HTTP response.
Affected versions
Published versions of
@tanstack/start-server-core,@tanstack/react-start,@tanstack/solid-start, and@tanstack/vue-startfrom1.143.12up to, but not including, their respective patched versions are affected. The patched versions are@tanstack/[email protected],@tanstack/[email protected],@tanstack/[email protected], and@tanstack/[email protected].Fix
The fix limits client-supplied server-function input to public fields and validates responses at the server boundary. Upgrade to the corresponding patched package version.
Temporary mitigations
For the configured server-function path, usually
/_serverFn/*, an edge or WAF rule can consider blocking requests without the literalx-tsr-serverFn: trueheader and browser document navigations such asSec-Fetch-Mode: navigateorAccept: text/html. A restrictive Content Security Policy on server-function responses can provide another browser-side restriction. These are mitigation suggestions, not a complete fix. The header is client-controlled and is not authentication. Test rules against legitimate GET and POST server functions and use a matching version-specific backport where possible.Credits
Lovable helped us discover and report this issue. We thank them for their help.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
TanStack/router (@tanstack/react-start)
v1.168.60Compare Source
Patch Changes
60b8ad1,41ebd28,614bc27,05223c2,d521abd,ff66a03,863c8a7]:v1.168.59Compare Source
Patch Changes
f5ffd38,488d046,e81845f,76a7c0b]:v1.168.58Compare Source
Patch Changes
73bfc15]:v1.168.57Compare Source
Patch Changes
222300b]:v1.168.56Compare Source
Patch Changes
v1.168.55Compare Source
Patch Changes
e561fa1,cbbfbe3,a1c8d1a,cbbfbe3,8e164d2]:v1.168.54Compare Source
Patch Changes
ab99818]:v1.168.53Compare Source
Patch Changes
b747fb8,6387d58,9b2adaf,634da91,e9396c9,6387d58,9872d2a,7e349c3,e9396c9]:v1.168.52Compare Source
Patch Changes
8c43c71,d914b08]:v1.168.51Compare Source
Patch Changes
aee42c6,49bcd4d,9c1871c,9aec5a7,919c397]:v1.168.50Compare Source
Patch Changes
2f20c00,28a5e45,f0b5eda,37877da,0497cae,0caf6b9,cf166d1]:Configuration
📅 Schedule: (in timezone Asia/Almaty)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.