A vulnerability in TanStack Start: what we found and what we did to protect your apps

Our security team found a vulnerability (CVE-2026-102989) in TanStack Start, reported it to the maintainers, and protected hosted apps with firewall rules while a fix was prepared. Here is what it means for your app.