Exported or self-hosted your Lovable app? How to patch the TanStack Start flaw (CVE-2026-102989)
| CVE | CVE-2026-102989 (GitHub advisory GHSA-qx66-fv34-fjm8) |
|---|---|
| What | Unauthenticated reflected cross-site scripting (CWE-79) in TanStack Start server-function responses |
| Severity | Critical, CVSS 3.1 score 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), as rated by GitHub, the CVE numbering authority. NVD lists the same score and hadn't published its own analysis as of Oct 18, 2026. |
| Fixed | Sep 30, 2026, in TanStack release release-2026-09-30-1747 |
| Found by | Lovable's security team, which reported it to TanStack |
What the flaw does
An attacker can craft a link to a server function in an affected TanStack Start app. If someone opens that link, the app can return attacker-controlled HTML from its own origin, and the attacker's JavaScript runs there. Because it runs on your site's own origin, the script can reach the same-origin data that visitor has access to and make requests with their authority.
Two things have to be true for the attack to work, according to Lovable: the app has the affected server functionality, and a visitor opens the malicious link. Using TanStack Start doesn't, by itself, make every app exploitable. Lovable says it found no evidence of exploitation in the logs it reviewed.
TanStack's advisory explains the cause: the server-function transport could pass request fields into internal state instead of limiting them to public input, and the response handling could then treat an attacker-shaped object as an HTTP response. The fix limits client-supplied input to public fields and validates responses at the server boundary. We won't go into more detail than that.
Am I affected?
Versions from 1.143.12 up to, but not including, the patched version are affected:
| Package | Affected | First patched |
|---|---|---|
@tanstack/start-server-core | >= 1.143.12, < 1.169.39 | 1.169.39 |
@tanstack/react-start | >= 1.143.12, < 1.168.60 | 1.168.60 |
@tanstack/solid-start | >= 1.143.12, < 1.168.57 | 1.168.57 |
@tanstack/vue-start | >= 1.143.12, < 1.168.56 | 1.168.56 |
Check the version your lockfile actually resolves, not just the one in package.json. With npm, run npm ls @tanstack/start-server-core. With pnpm, run pnpm why @tanstack/start-server-core. TanStack says the resolved @tanstack/start-server-core should be 1.169.39 or later.
The fix, by where your app runs
Hosted on Lovable
Lovable put firewall rules in front of hosted apps while the fix was prepared, and they stay in place while projects are updated. The next time you make a change, Lovable's coding agent upgrades TanStack Start to the patched version. To apply it now without other changes, use your project's Security page, which costs no credits. New projects start on the patched version. Not every Lovable project was affected, and Lovable says it will email the owners of affected projects.
Exported, or self-hosted anywhere else
- Upgrade your Start package to at least its patched version, for example
npm install @tanstack/react-start@^1.168.60(usesolid-startorvue-startif that's your framework). - Update the lockfile and confirm
@tanstack/start-server-coreresolves to 1.169.39 or later. - Rebuild and redeploy. In TanStack's words: "Updating a local installation alone doesn't patch an already deployed application."
If you can't upgrade today
The advisory suggests temporary mitigations and is explicit that they're not a complete fix:
- On the server-function path (usually
/_serverFn/*), an edge or WAF rule can block requests that lack the literal headerx-tsr-serverFn: true, and block browser page navigations (such asSec-Fetch-Mode: navigateorAccept: text/html). - A restrictive Content Security Policy on server-function responses adds a browser-side restriction.
That header is set by the client, so it isn't authentication. Test any rule against your real GET and POST server functions before relying on it, and upgrade as soon as you can.
Timeline
- Sep 14, 2026: a researcher on Lovable's security team finds the issue and reports it to TanStack. Lovable then starts enforcing firewall rules for apps it hosts.
- Sep 30, 2026: TanStack ships the patched packages and publishes its advisory and blog post. Lovable publishes its notice.
- Oct 13, 2026: the CVE record is published at MITRE and NVD.
Sources
- TanStack security advisory: GHSA-qx66-fv34-fjm8
- CVE record: cve.org · NVD
- Fix release: release-2026-09-30-1747
- TanStack: TanStack Start security update: CVE-2026-102989
- Lovable: What we found and what we did to protect your apps
What we can and can't check. Our free scan looks at your live app from the outside: headers, TLS, exposed files and keys shipped in your JavaScript. It doesn't read your lockfile, so it can't tell you which TanStack version you run. The Code Audit reviews your dependencies along with your source.