CVE-2026-45321
TanStack — TanStack Unspecified Vulnerability
TanStack · CWE-506 · in CISA KEV since 2026-05-27
EVRS 85 of 100 Immediate
Out-of-Band / Urgent Remediation
Rank 455 of 2,962 tracked
Raised to the floor for a confirmed exploited vulnerability.
Why it scores 85
Evidence available: 6 of 7 signalsListed in the CISA KEV catalog, and associated with known ransomware campaigns.
- CISA KEVApplied
- RansomwareApplied
- Vendor exploitationDid not apply
- EPSSApplied
- Microsoft Exploitability IndexNot applicable
- Pre-patch disclosureNo data
- KEV recencyDid not apply
- CVSSApplied
The band answers “how soon”, not “how bad”. No data for: Pre-patch disclosure. Why some signals show no data
Fix
Patch or fixed version identifiedCISA required action
- This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see
- nvd.nist.gov/…/CVE-2026-45321
Fixed in
- @tanstack/arktype-adapter
1.166.16 - @tanstack/eslint-plugin-router
1.161.13 - @tanstack/eslint-plugin-start
0.0.8 - @tanstack/history
1.161.13 - @tanstack/nitro-v2-vite-plugin
1.154.16 - @tanstack/react-router
1.169.9 - @tanstack/react-router-devtools
1.166.20 - @tanstack/react-router-ssr-query
1.166.19
Affected versions
- @tanstack/arktype-adapter (npm)
affected = 1.166.12, fixed in 1.166.16 - @tanstack/eslint-plugin-router (npm)
affected = 1.161.9, fixed in 1.161.13 - @tanstack/eslint-plugin-start (npm)
affected = 0.0.4, fixed in 0.0.8 - @tanstack/history (npm)
affected = 1.161.9, fixed in 1.161.13 - @tanstack/nitro-v2-vite-plugin (npm)
affected = 1.154.12, fixed in 1.154.16 - @tanstack/react-router (npm)
affected = 1.169.5, fixed in 1.169.9 - @tanstack/react-router-devtools (npm)
affected = 1.166.16, fixed in 1.166.20 - @tanstack/react-router-ssr-query (npm)
affected = 1.166.15, fixed in 1.166.19
+163 more affected products; see the full list at NVD.
Remediation
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Fixed versions from NVD and GitHub. Affected packages also in GitHub Advisory GHSA-g7cv-rxg3-hmpx (CC BY 4.0). It lists 76 more packages; see GHSA-g7cv-rxg3-hmpx on GitHub for the full list.
Evidence
Each value with its source| Measure | Value | Source |
|---|---|---|
| CVSS base scoreHow severe the flaw is in itself. It does not say how likely an attack is. | 9.6 | NVD |
| FIRST EPSSFIRST's estimate of the chance this is exploited in the next 30 days, and how that ranks against all CVEs. | 0.011 (64.1st pctl) | FIRST EPSS |
| Actively exploitedWhether a source of record has confirmed attacks using it in the wild. | Confirmed | CISA KEV |
| Ransomware campaign useWhether CISA has seen ransomware operators use it. | Known | CISA KEV |
| CISA remediation deadlineThe date US federal agencies must have fixed or mitigated it. | 2026-06-10 · CISA federal deadline · Overdue by 4 months | CISA KEV |
| Public exploit moduleA module existing is not the same as active exploitation. | None known | Metasploit |
| EUVD cross-referenceENISA's record: CVSS 9.6 (v3.1), assigned by GitHub_M. | Listed | ENISA EUVD |
Description
NVDOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.
What CISA says to do