CVE-2026-102989: router < release-2026-09-30-1747; +4 more affected products

Affected technology

router · < release-2026-09-30-1747
TanStack

react-start · >= 1.143.12, < 1.168.60
@tanstack

solid-start · >= 1.143.12, < 1.168.57
@tanstack

start-server-core · >= 1.143.12, < 1.169.39
@tanstack

vue-start · >= 1.143.12, < 1.168.56
@tanstack

Component: Not specified by the source
Function: request, URL

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

An unauthenticated attacker can place non-public fields in a server-function request payload so that attacker-controlled middleware state reaches the error path and a response-shaped object is accepted as an HTTP response. Vendor/CNA’s CVSS 3.1 assessment (base score 9.3/10) rates confidentiality and integrity impact as high; availability impact as none.