Detections
Analytics

SCA: security update for @tanstack/react-start, @tanstack/solid-start, @tanstack/start-server-core, @tanstack/vue-start (GHSA-qx66-fv34-fjm8)

critical Tenable Self-Hosted Container Security Plugin ID 474698

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the
 web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start,
 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an unauthenticated attacker can
 place non-public fields in a server-function request payload so that attacker-controlled middleware state
 reaches the error path and a response-shaped object is accepted as an HTTP response. A crafted server-
 function URL can therefore return attacker-controlled HTML from the application's origin; when a visitor
 opens the URL, the injected script can access same-origin data and issue requests with the visitor's
 authority. This issue is fixed in @tanstack/start-server-core 1.169.39, @tanstack/react-start 1.168.60,
 @tanstack/solid-start 1.168.57, and @tanstack/vue-start 1.168.56. (CVE-2026-102989)

Solution

Update the @tanstack/vue-start library and its related packages to version 1.168.56 or later.

See Also

https://github.com/advisories/GHSA-qx66-fv34-fjm8

Plugin Details

Severity: Critical

ID: 474698

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.8

Percentile: 57.96

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2026-102989

CVSS v3

Risk Factor: Critical

Base Score: 9.3

Temporal Score: 8.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/15/2026

Vulnerability Publication Date: 10/13/2026

Reference Information

CVE: CVE-2026-102989

cwe: CWE-79