TanStack
Bug: Only the last setCookie takes effect on the server route
Which project does this relate to?
Start
Describe the bug
When trying to set multiple cookies in a server handler using setCookie, only the last cookie gets actually set in the browser. All previous setCookie calls seem to be overridden or ignored.
Your Example Website or App
https://github.com/Mr-Alexandre/bug-repro-tanstack-start-cookie
Steps to Reproduce the Bug or Issue
- Start the dev server (e.g.,
pnpm dev). - Open your browser and go to http://localhost:3000/api/set-cookies.
- Open DevTools → Network tab → Select the request to
/api/set-cookies. - Check the "Set-Cookie" headers in the Response Headers.
- You will see that only the last cookie is set.
Expected behavior
As a user, I expected multiple Set-Cookie headers to be sent and both cookies to be set, but I am seeing only the last one is applied. The previous one is missing.
Screenshots or Videos
https://github.com/user-attachments/assets/cbbc9ff2-c8c7-44d3-9c4b-76c4471191c7
Platform
- Router / Start Version: [e.g. 1.121.0]
- OS: [macOS]
- Browser: [Chrome]
- Browser Version: [140.0.7339.214]
- Bundler: [vite]
- Bundler Version: [7.1.7]
Additional context
This bug happens consistently and prevents setting multiple cookies for auth/session scenarios. Possibly related to how Response headers are managed in TanStack Start server handlers.
I cannot reproduce this issue from the bug example repo with the following browsers:
Zen Browser (Firefox based) 1.16.4b (Firefox 143.0.4) (64-bit)
Chromium Version 141.0.7390.76 (Official Build) Arch Linux (64-bit)
OS: Arch Linux x86_64 (Kernal Linux 6.12.51-1-lts)
It's possible I'm missing something though, just thought I'd give it a shot to see if I can track down what's happening in the H3 setCookie call but like I said, I was unable to reproduce.
I’ve tested this issue across multiple versions and confirmed that it only appears in the latest releases.
Works correctly in: { "@tanstack/react-router": "^1.131.48", "@tanstack/react-router-devtools": "^1.131.48", "@tanstack/react-router-ssr-query": "^1.131.48", "@tanstack/react-start": "^1.131.48", "@tanstack/router-plugin": "^1.131.48" }
Bug reproduced in: { "@tanstack/react-router": "^1.132.0", "@tanstack/react-router-devtools": "^1.132.0", "@tanstack/react-router-ssr-query": "^1.131.7", "@tanstack/react-start": "^1.132.0", "@tanstack/router-plugin": "^1.132.0" }
Tested on: • Device: MacBook Pro M4 Pro • OS: macOS 15.6.1 • Browsers: • Chrome 141.0.7390.77 • Safari 18.6 (20621.3.11.11.3)
Chrome 141.0.7390.77
Safari 18.6 (20621.3.11.11.3)
I’ve identified the root cause more precisely. The issue only occurs when using Node.js v20.19.2.
After upgrading to Node.js v22.2.0, the problem no longer occurs — both cookies are properly set and received by the browser.
✅ Working: • Node.js v22.2.0 – ✅ multiple Set-Cookie headers work
❌ Broken: • Node.js v20.19.2 – ❌ only the last Set-Cookie is set
