External risk intelligence

TanStack Router Server-Function Request Vulnerability Allows HTML Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-102989

The vulnerability affects TanStack Router, a web framework used to build internet-facing web applications. Because the flaw involves manipulating server-function requests to return attacker-controlled content from the application's origin, it is commonly deployed in public-facing web environments where such endpoints are reachable.

Cross-site Scripting

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in the TanStack Router framework, which is used for building web applications. An unauthenticated attacker could potentially exploit this flaw to return attacker-controlled HTML from your application's origin, allowing injected scripts to access sensitive same-origin data and perform actions on behalf of users.

Flaw allows attackers to inject content into web applications.
Could expose sensitive user data and actions.
Confirm relevance and exposure to user data.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this by sending a specially crafted server-function request. This request manipulates the server to include non-public fields, which allows attacker-controlled data to reach an error handling path. The server then incorrectly processes this data, leading to a response that contains attacker-controlled HTML. When a user visits a crafted URL, malicious scripts within the injected HTML can access sensitive data and perform actions on behalf of the user.

Unauthenticated access required.
Craft server-function request payload.
Inject HTML, steal data, impersonate users.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an unauthenticated attacker could craft a server-function URL to return attacker-controlled HTML. This could allow injected scripts to access same-origin data and issue requests with the visitor's authority.

Application origin and same-origin data at risk.
Exploited via crafted server-function URLs.
Potential for unauthorized data access/actions.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world action for this vulnerability likely involves application owners and platform teams responsible for the TanStack Router implementation. The first practical step is to inventory all instances of the affected technology, determine their reachability and criticality, identify the accountable team or individual, and then develop a remediation plan based on the identified risk.

Application owners should lead remediation efforts.
Verify affected TanStack Router instances and exposure.
Plan for vendor coordination and application updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is TanStack Router?

TanStack Router is a client-first, server-capable framework designed for building type-safe, full-stack web applications. It simplifies routing and state management for developers using libraries like React, Solid, or Vue. By handling both client-side navigation and server-side functions, it serves as the backbone for modern web traffic, managing how requests are processed and how data is delivered to a user's browser.

What is the vulnerability in CVE-2026-102989?

This flaw is classified as CWE-79, or Improper Neutralization of Input During Web Page Generation. In simple terms, the framework fails to properly sanitize requests, allowing an attacker to inject unauthorized HTML. Because the server treats the attacker's data as a valid response, the browser renders it as if it originated from your own trusted application, enabling the execution of malicious scripts.

How can an attacker trigger this vulnerability?

An unauthenticated attacker triggers this by sending a specially crafted server-function request that includes non-public fields. These fields manipulate the application's internal error handling, forcing it to serve an attacker-controlled object as an HTTP response. Normal, valid requests that do not attempt to inject non-public fields into the payload will not trigger this error path.

Is my application at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a 'Likely' concern because TanStack Router is predominantly used for internet-facing web applications. Since the attack relies on reaching server-function endpoints, public-facing sites are the primary target. If your application handles sensitive same-origin data and is reachable over the internet, it is at higher risk of being used to impersonate your users.

What should I do to address this CVE?

Your first step is to inventory your environment to identify every instance of the affected TanStack packages—specifically @tanstack/start-server-core and its framework-specific counterparts. Once identified, coordinate with your development team to update these components to the patched versions listed in the advisory. This ensures the framework correctly validates server-function requests and prevents the processing of unauthorized payload fields.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.