---
id: "CVE-2026-102989"
kind: "vulnerability"
aliases: ["CVE-2026-102989"]
title: "TanStack Router: unauthenticated reflected XSS can hijack user sessions"
severity: "critical"
cvss: 9.3
epss: 0.00516
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cloudflare", "lab-disclosure", "package", "tanstack-router", "web-apps"]
not_affected_if: []
published_at: "2026-10-12T17:17:57+00:00"
first_seen_at: "2026-10-24T17:18:15+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "lab", "url": "https://developers.cloudflare.com/changelog/post/2026-10-12-waf-release/", "first_seen_at": "2026-10-24T17:18:15+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102989", "first_seen_at": "2026-10-24T17:18:50+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-102989", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# TanStack Router: unauthenticated reflected XSS can hijack user sessions

TanStack Router has a reflected cross-site scripting flaw that lets an unauthenticated attacker inject scripts into pages other users view. The sources say this can lead to session hijacking or unauthorized actions in the victim's browser.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown: the sources do not name the affected TanStack Router versions or the code path that reflects input.
- Cloudflare WAF customers: check whether the managed rule `TanStack - Reflected XSS - CVE:CVE-2026-102989` is present and set to Block.

## Fix

- Upgrade TanStack Router to a patched release; the version is unknown from these sources.
- Cloudflare WAF customers: set the managed rule `TanStack - Reflected XSS - CVE:CVE-2026-102989` to Block, as the Cloudflare changelog describes.

## Mitigated for you by

- Cloudflare (waf-rule, since 2026-10-12): covers Requests matching the TanStack reflected XSS pattern, via Cloudflare Managed Ruleset rule TanStack - Reflected XSS - CVE:CVE-2026-102989 Limits: Only traffic proxied through Cloudflare; the rule covers only the detected pattern Still: none stated https://developers.cloudflare.com/changelog/post/2026-10-12-waf-release/

## Timeline

- 2026-10-24T17:18:15+00:00 lab https://developers.cloudflare.com/changelog/post/2026-10-12-waf-release/ — Cloudflare: WAF Release - 2026-10-12 · Changelog
- 2026-10-24T17:18:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-102989
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-102989

## Documents

- [advisory] Cloudflare: WAF Release - 2026-10-12 · Changelog https://developers.cloudflare.com/changelog/post/2026-10-12-waf-release/

## From the sources

WAF Release - 2026-10-12 · Changelog

# Changelog

New updates and improvements at Cloudflare.

October 12, 2026

## WAF Release - 2026-10-12

This release introduces new detections to mitigate recent vulnerabilities affecting TanStack and Atlassian products.

Key Findings

- CVE-2026-102989: A reflected Cross-Site Scripting (XSS) vulnerability affecting TanStack. Unauthenticated attackers can exploit this flaw to inject malicious scripts into web pages viewed by other users, potentially leading to session hijacking or unauthorized actions.
- CVE-2026-21589: An arbitrary file access vulnerability affecting Atlassian products. Threat actors can exploit this flaw to read unauthorized files on the target system, risking the exposure of sensitive configuration data.

| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
| --- | --- | --- | --- | --- | --- | --- |
| Cloudflare Managed Ruleset | ...02751ef3 | N/A | Generic Rules - Template Injection - 2 - Beta | Disabled | Disabled | This rule is merged into the original rule "Generic Rules - Template Injection - 2" (ID: ...d3ed0123). |
| Cloudflare Managed Ruleset | ...4ee560b2 | N/A | TanStack - Reflected XSS - CVE:CVE-2026-102989 | N/A | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...e919cd31 | N/A | Atlassian - Arbitrary File Access - CVE:CVE-2026-21589 | N/A | Block | This is a new detection. |

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_