# Risk map — TanStack/router

> Canonical page: https://codevetter.com/unpack/router/risk-map

# Risk map — TanStack/router

Scanned commit 1f0f20a3206a28365d74fd2485b9a8eedbf74dd0 (2026-10-01). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The main sensitive boundaries are URL interpretation, RPC decoding, middleware trust, SSR stream ownership, and generator filesystem access. Several protections are explicit, but their effectiveness has not been dynamically verified here. The risks below are source observations or labeled hypotheses, not confirmed vulnerabilities. Test limitations are specific to the inspected files and do not imply whole-repository absence of coverage.
- CSRF configuration changes when an application supplies a Start instance: the implicit default middleware is used only without that instance, and a missing custom CSRF middleware produces a nonproduction warning rather than automatic installation. — [packages/start-server-core/src/createStartHandler.ts#L589-L602](https://github.com/TanStack/router/blob/1f0f20a3206a28365d74fd2485b9a8eedbf74dd0/packages/start-server-core/src/createStartHandler.ts#L589-L602) [packages/start-server-core/src/createStartHandler.ts#L660-L666](https://github.com/TanStack/router/blob/1f0f20a3206a28365d74fd2485b9a8eedbf74dd0/packages/start-server-core/src/createStartHandler.ts#L660-L666)
- CSRF validation prioritizes Sec-Fetch-Site, then Origin, then Referer; requests lacking all applicable checks are denied unless allowRequestsWithoutOriginCheck is explicitly true. — [packages/start-client-core/src/createCsrfMiddleware.ts#L105-L150](https://github.com/TanStack/router/blob/1f0f20a3206a28365d74fd2485b9a8eedbf74dd0/packages/start-client-core/src/createCsrfMiddleware.ts#L105-L150)
- RPC checks the declared HTTP method before parsing and applies an explicit size limit to GET payload strings; the inspected POST JSON and FormData branches invoke request parsers without that same local size check. — [packages/start-server-core/src/server-functions-handler.ts#L83-L95](https://github.com/TanStack/router/blob/1f0f20a3206a28365d74fd2485b9a8eedbf74dd0/packages/start-server-core/src/server-functions-handler.ts#L83-L95) [packages/start-server-core/src/server-functions-handler.ts#L119-L120](https://github.com/TanStack/router/blob/1f0f20a3206a28365d74fd2485b9a8eedbf74dd0/packages/start-server-core/src/server-functions-handler.ts#L119-L120) [packages/start-server-core/src/server-functions-handler.ts#L149-L171](https://github.com/TanStack/router/blob/1f0f20a3206a28365d74fd2485b9a8eedbf74dd0/packages/start-server-core/src/server-functions-handler.ts#L149-L171)
- Client-supplied RPC context crosses a trust boundary in GET, JSON, and FormData; safeObjectMerge places server context last, and repository instructions require preserving that precedence. — [packages/start-server-core/src/server-functions-handler.ts#L128-L138](https://github.com/TanStack/router/blob/1f0f20a3206a28365d74fd2485b9a8eedbf74dd0/packages/start-server-core/src/server-functions-handler.ts#L128-L138) [packages/start-server-core/src/server-functions-handler.ts#L159-L171](https://github.com/TanStack/router/blob/1f0f20a3206a28365d74fd2485b9a8eedbf74dd0/packages/start-server-core/src/server-functions-handler.ts#L159-L171) [packages/start-server-core/AGENTS.md#L5-L6](https://github.com/TanStack/router/blob/1f0f20a3206a28365d74fd2485b9a8eedbf74dd0/packages/start-server-core/AGENTS.md#L5-L6)
- Redirect handling rejects protocol-relative/control-character variants and schemes outside protocolAllowlist, while intentionally allowing external HTTP(S) redirects; same-origin enforcement is not a blanket redirect policy. — [packages/router-core/src/router.ts#L2575-L2605](https://github.com/TanStack/router/blob/1f0f20a3206a28365d74fd2485b9a8eedbf74dd0/packages/router-core/src/router.ts#L2575-L2605)
- SSR transport recognizes fixed byte patterns rather than parsing HTML; its documented contract requires Scripts in body and forbids an earlier exact </body></html> in raw data after the hydration boundary. — [packages/router-core/src/ssr/STREAMING.md#L42-L47](https://github.com/TanStack/router/blob/1f0f20a3206a28365d74fd2485b9a8eedbf74dd0/packages/router-core/src/ssr/STREAMING.md#L42-L47) [packages/router-core/src/ssr/STREAMING.md#L122-L135](https://github.com/TanStack/router/blob/1f0f20a3206a28365d74fd2485b9a8eedbf74dd0/packages/router-core/src/ssr/STREAMING.md#L122-L135)
- Generator routesDirectory, generatedRouteTree, and tmpDir can resolve to absolute paths outside the project; safeFileWrite performs writes, chmod/chown, and rename at those configured locations. — [packages/router-generator/src/config.ts#L129-L170](https://github.com/TanStack/router/blob/1f0f20a3206a28365d74fd2485b9a8eedbf74dd0/packages/router-generator/src/config.ts#L129-L170) [packages/router-generator/src/generator.ts#L1214-L1235](https://github.com/TanStack/router/blob/1f0f20a3206a28365d74fd2485b9a8eedbf74dd0/packages/router-generator/src/generator.ts#L1214-L1235) [packages/router-generator/src/generator.ts#L1259-L1280](https://github.com/TanStack/router/blob/1f0f20a3206a28365d74fd2485b9a8eedbf74dd0/packages/router-generator/src/generator.ts#L1259-L1280)
- Hypothesis: a generator regression that stops throwing for an invalid fixture could escape the inspected expected-error branch, because its assertions execute only inside catch and it does not assert rejection or fail after normal completion. (inferred) — [packages/router-generator/tests/generator.test.ts#L370-L378](https://github.com/TanStack/router/blob/1f0f20a3206a28365d74fd2485b9a8eedbf74dd0/packages/router-generator/tests/generator.test.ts#L370-L378)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)