TanStack, the collection of open source web development libraries led by Tanner Linsley, is having its busiest month yet: TanStack Start, its full-stack framework, reached a stable 1.0 on October 13, and TanStack AI hit 1.0 on October 23. The MIT-licensed project, which has no paid tiers, now has close to 130,000 GitHub stars and around 74 million weekly downloads, according to its own website. It powers widely used tools such as TanStack Query and, since May, the apps generated by Lovable.
TanStack in 30 seconds
- TanStack is a family of MIT-licensed TypeScript libraries for data fetching, routing, tables, forms, virtualization and AI.
- Its libraries are largely framework-agnostic, strongly typed and headless, with no built-in styles.
- TanStack Start 1.0 has been stable since October 13 and deploys to Cloudflare, Netlify, Vercel, Node.js and more.
- A critical reflected XSS flaw in September required teams to update, rebuild and redeploy.
The project’s philosophy comes down to three ideas. Much of its logic is framework-agnostic, with adapters for React, Vue, Solid, Svelte or Angular depending on the library. Everything is designed around end-to-end TypeScript type safety. And most of its pieces are headless: they provide the logic and hooks but no styles or visual components, so each team decides how its interface looks.
The libraries that make up TanStack
TanStack Query, formerly React Query, is the best known, with more than 50,000 GitHub stars. It handles asynchronous state, caching and synchronisation of the data an application fetches from the server. TanStack Table, with around 28,000 stars, is used to build advanced tables and data grids without predefined visual components, and version 9 was announced in August. TanStack Router is a fully type-safe router that also serves as the foundation for a full-stack framework.
That framework is TanStack Start, built on Router, with server-side rendering, streaming and server functions, and using Vite as its development tool. The rest of the catalogue covers specific needs: TanStack Form handles type-safe form state and has version 2 in alpha; TanStack Virtual virtualises very long lists so only visible items are rendered; TanStack DB is a reactive client-side store synced with an API; and TanStack AI is a provider-agnostic TypeScript SDK for streaming chat, tool calling and agents. Its 1.0 release has stable core APIs, while the agent harness remains experimental. Smaller pieces round out the family, including Store, Pacer for debouncing, throttling and queueing calls, Hotkeys, and Charts, which reached 1.0 on October 5.
Where TanStack Start can run
For whoever runs the infrastructure, the key point about TanStack Start is that it does not lock you into one provider. The official documentation covers deployments to Cloudflare Workers, Netlify, Vercel, Render, Railway and Appwrite Sites, plus Node.js, Docker and Bun through Nitro, a provider-agnostic deployment layer that the project itself says is still under active development. On Node.js you build the app and start the generated server with node .output/server/index.mjs, which fits any container or self-managed server.
That portability is part of what has made it an appealing alternative to Next.js, as we covered when TanStack Start was emerging as a developer-first bet beyond Next.js. The most striking example is Lovable, which generates its new apps with TanStack Start and has moved its own website from Next.js on Vercel to TanStack Start on Cloudflare Workers. Cloudflare, Netlify, Vercel, Render, Railway and Lovable are among the project’s main partners, which secures its funding but is also worth keeping in mind when reading its announcements.
What sysadmins should watch
On September 30 the project published a security update for CVE-2026-102989, a reflected cross-site scripting flaw in server-function response handling that its author described as critical. An unauthenticated attacker could craft a server-function URL that returned attacker-controlled HTML from the application’s own origin, and if a user opened it, the attacker’s JavaScript ran with that user’s access. It affects versions from 1.143.12 and is fixed in @tanstack/react-start 1.168.60, @tanstack/solid-start 1.168.57, @tanstack/vue-start 1.168.56 and @tanstack/start-server-core 1.169.39. Lovable helped discover the issue.
The project’s warning applies well beyond this case: updating dependencies locally does not patch an application that is already deployed. Teams need to update the lockfile, confirm that the resolved start-server-core version is the fixed one, rebuild and redeploy. Edge mitigations such as WAF rules can help in the meantime, but they do not replace the patch. In environments with many small applications, such as those created by AI app builders, it pays to keep an inventory of which library versions are running in production.
Frequently asked questions
What is TanStack?
A collection of MIT-licensed open source web development libraries with strong TypeScript typing, a headless approach and adapters for several frameworks. Its main driving force is Tanner Linsley.
What is the difference between TanStack Router and TanStack Start?
Router is the fully type-safe router. Start is a full-stack framework built on Router that adds server-side rendering, streaming and server functions.
Where can TanStack Start be deployed?
On Cloudflare Workers, Netlify, Vercel, Render, Railway and Appwrite Sites, and on Node.js, Docker or Bun through Nitro.
Am I affected by CVE-2026-102989?
If you run TanStack Start from version 1.143.12 without updating. The fixed @tanstack/start-server-core version is 1.169.39, and you need to rebuild and redeploy.
Sources: