CVEs / CVE-2026-45321
CVE-2026-45321: TanStack Unspecified Vulnerability
- Known exploited in the CISA KEV catalog since 27 May 2026
- critical 9.6 CVSS 3.1 (from the CNA)
- EPSS 3.27% chance of exploitation in the next 30 days, higher than 88% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2026-45321
Summary
TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity.
Description
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| @tanstack arktype-adapter | 1.166.12 | — |
| @tanstack arktype-adapter | 1.166.15 | — |
| @tanstack eslint-plugin-router | 1.161.9 | — |
| @tanstack eslint-plugin-router | 1.161.12 | — |
| @tanstack eslint-plugin-start | 0.0.4 | — |
| @tanstack eslint-plugin-start | 0.0.7 | — |
| @tanstack history | 1.161.9 | — |
| @tanstack history | 1.161.12 | — |
| @tanstack nitro-v2-vite-plugin | 1.154.12 | — |
| @tanstack nitro-v2-vite-plugin | 1.154.15 | — |
| @tanstack react-router | 1.169.5 | — |
| @tanstack react-router | 1.169.8 | — |
| @tanstack react-router-devtools | 1.166.16 | — |
| @tanstack react-router-devtools | 1.166.19 | — |
| @tanstack react-router-ssr-query | 1.166.15 | — |
| @tanstack react-router-ssr-query | 1.166.18 | — |
| @tanstack react-start | 1.167.68 | — |
| @tanstack react-start | 1.167.71 | — |
| @tanstack react-start-client | 1.166.51 | — |
| @tanstack react-start-client | 1.166.54 | — |
| @tanstack react-start-rsc | 0.0.47 | — |
| @tanstack react-start-rsc | 0.0.50 | — |
| @tanstack react-start-server | 1.166.55 | — |
| @tanstack react-start-server | 1.166.58 | — |
| @tanstack router-cli | 1.166.46 | — |
| @tanstack router-cli | 1.166.49 | — |
| @tanstack router-core | 1.169.5 | — |
| @tanstack router-core | 1.169.8 | — |
| @tanstack router-devtools | 1.166.16 | — |
| @tanstack router-devtools | 1.166.19 | — |
| Product | Affected | Fixed in |
|---|---|---|
| @tanstack/arktype-adapter (npm) | from 1.166.12, before 1.166.16 | 1.166.16 |
| @tanstack/eslint-plugin-router (npm) | from 1.161.9, before 1.161.13 | 1.161.13 |
| @tanstack/eslint-plugin-start (npm) | from 0.0.4, before 0.0.8 | 0.0.8 |
| @tanstack/history (npm) | from 1.161.9, before 1.161.13 | 1.161.13 |
| @tanstack/nitro-v2-vite-plugin (npm) | from 1.154.12, before 1.154.16 | 1.154.16 |
| @tanstack/react-router (npm) | from 1.169.5, before 1.169.9 | 1.169.9 |
| @tanstack/react-router-devtools (npm) | from 1.166.16, before 1.166.20 | 1.166.20 |
| @tanstack/react-router-ssr-query (npm) | from 1.166.15, before 1.166.19 | 1.166.19 |
| @tanstack/react-start (npm) | from 1.167.68, before 1.167.72 | 1.167.72 |
| @tanstack/react-start-client (npm) | from 1.166.51, before 1.166.55 | 1.166.55 |
| @tanstack/react-start-rsc (npm) | from 0.0.47, before 0.0.51 | 0.0.51 |
| @tanstack/react-start-server (npm) | from 1.166.55, before 1.166.59 | 1.166.59 |
| @tanstack/router-cli (npm) | from 1.166.46, before 1.166.50 | 1.166.50 |
| @tanstack/router-core (npm) | from 1.169.5, before 1.169.9 | 1.169.9 |
| @tanstack/router-devtools (npm) | from 1.166.16, before 1.166.20 | 1.166.20 |
| @tanstack/router-devtools-core (npm) | from 1.167.6, before 1.167.10 | 1.167.10 |
| @tanstack/router-generator (npm) | from 1.166.45, before 1.166.49 | 1.166.49 |
| @tanstack/router-plugin (npm) | from 1.167.38, before 1.167.42 | 1.167.42 |
| @tanstack/router-ssr-query-core (npm) | from 1.168.3, before 1.168.7 | 1.168.7 |
| @tanstack/router-utils (npm) | from 1.161.11, before 1.161.15 | 1.161.15 |
| @tanstack/router-vite-plugin (npm) | from 1.166.53, before 1.166.57 | 1.166.57 |
| @tanstack/solid-router (npm) | from 1.169.5, before 1.169.9 | 1.169.9 |
| @tanstack/solid-router-devtools (npm) | from 1.166.16, before 1.166.20 | 1.166.20 |
| @tanstack/solid-router-ssr-query (npm) | from 1.166.15, before 1.166.19 | 1.166.19 |
| @tanstack/solid-start (npm) | from 1.167.65, before 1.167.69 | 1.167.69 |
| @tanstack/solid-start-client (npm) | from 1.166.50, before 1.166.54 | 1.166.54 |
| @tanstack/solid-start-server (npm) | from 1.166.54, before 1.166.58 | 1.166.58 |
| @tanstack/start-client-core (npm) | from 1.168.5, before 1.168.9 | 1.168.9 |
| @tanstack/start-fn-stubs (npm) | from 1.161.9, before 1.161.13 | 1.161.13 |
| @tanstack/start-plugin-core (npm) | from 1.169.23, before 1.169.27 | 1.169.27 |
Package versions from GHSA-g7cv-rxg3-hmpx.
Exploitation
| In CISA KEV since | 27 May 2026 |
|---|---|
| Due date for US federal agencies | 10 Jun 2026 |
| Used in ransomware campaigns | Known |
| Required action | Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. |
Severity
| CVSS 3.1 | 9.6 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HScored by the CNA ([email protected]) |
|---|---|
| Weakness | CWE-506 |
References
- CVE-2026-45321 on NVD
- CVE-2026-45321 in the CISA KEV catalog
- https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx (cited by CISA)
- CVE-2026-45321 on OSV
- https://github.com/TanStack/router/issues/7383 Issue Tracking
- https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx Mitigation, Vendor Advisory
- https://tanstack.com/blog/npm-supply-chain-compromise-postmortem Exploit, Vendor Advisory
- https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem Exploit, Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45321 US Government Resource
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.