MSRXCVE-2026-45321
CVE-2026-45321
TanStack Unspecified Vulnerability
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVSS 3.1 · CNA · github.com
chance of exploitation in the next 30 days (EPSS; higher than 88% of CVEs)
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.
Scores
Affected packages and fixed versions
| Package | Ecosystem | Fixed in |
|---|---|---|
| @tanstack/arktype-adapter | npm | 1.166.16 |
| @tanstack/eslint-plugin-router | npm | 1.161.13 |
| @tanstack/eslint-plugin-start | npm | 0.0.8 |
| @tanstack/history | npm | 1.161.13 |
| @tanstack/nitro-v2-vite-plugin | npm | 1.154.16 |
| @tanstack/react-router | npm | 1.169.9 |
| @tanstack/react-router-devtools | npm | 1.166.20 |
| @tanstack/react-router-ssr-query | npm | 1.166.19 |
| @tanstack/react-start | npm | 1.167.72 |
| @tanstack/react-start-client | npm | 1.166.55 |
| @tanstack/react-start-rsc | npm | 0.0.51 |
| @tanstack/react-start-server | npm | 1.166.59 |
| @tanstack/router-cli | npm | 1.166.50 |
| @tanstack/router-core | npm | 1.169.9 |
| @tanstack/router-devtools | npm | 1.166.20 |
| @tanstack/router-devtools-core | npm | 1.167.10 |
| @tanstack/router-generator | npm | 1.166.49 |
| @tanstack/router-plugin | npm | 1.167.42 |
| @tanstack/router-ssr-query-core | npm | 1.168.7 |
| @tanstack/router-utils | npm | 1.161.15 |
| @tanstack/router-vite-plugin | npm | 1.166.57 |
| @tanstack/solid-router | npm | 1.169.9 |
| @tanstack/solid-router-devtools | npm | 1.166.20 |
| @tanstack/solid-router-ssr-query | npm | 1.166.19 |
| @tanstack/solid-start | npm | 1.167.69 |
| @tanstack/solid-start-client | npm | 1.166.54 |
| @tanstack/solid-start-server | npm | 1.166.58 |
| @tanstack/start-client-core | npm | 1.168.9 |
| @tanstack/start-fn-stubs | npm | 1.161.13 |
| @tanstack/start-plugin-core | npm | 1.169.27 |
| @tanstack/start-server-core | npm | 1.167.37 |
| @tanstack/start-static-server-functions | npm | 1.166.48 |
| @tanstack/start-storage-context | npm | 1.166.42 |
| @tanstack/valibot-adapter | npm | 1.166.16 |
| @tanstack/virtual-file-routes | npm | 1.161.14 |
| @tanstack/vue-router | npm | 1.169.9 |
| @tanstack/vue-router-devtools | npm | 1.166.20 |
| @tanstack/vue-router-ssr-query | npm | 1.166.19 |
| @tanstack/vue-start | npm | 1.167.65 |
| @tanstack/vue-start-client | npm | 1.166.50 |
Affected products
- tanstack tanstack\/arktype-adapter: 1.166.12; 1.166.15
- tanstack tanstack\/eslint-plugin-router: 1.161.9; 1.161.12
- tanstack tanstack\/eslint-plugin-start: 0.0.4; 0.0.7
- tanstack tanstack\/history: 1.161.9; 1.161.12
- tanstack tanstack\/nitro-v2-vite-plugin: 1.154.12; 1.154.15
- tanstack tanstack\/react-router: 1.169.5; 1.169.8
- tanstack tanstack\/react-router-devtools: 1.166.16; 1.166.19
- tanstack tanstack\/react-router-ssr-query: 1.166.15; 1.166.18
- tanstack tanstack\/react-start: 1.167.68; 1.167.71
- tanstack tanstack\/react-start-client: 1.166.51; 1.166.54
- tanstack tanstack\/react-start-rsc: 0.0.47; 0.0.50
- tanstack tanstack\/react-start-server: 1.166.55; 1.166.58
- tanstack tanstack\/router-cli: 1.166.46; 1.166.49
- tanstack tanstack\/router-core: 1.169.5; 1.169.8
- tanstack tanstack\/router-devtools: 1.166.16; 1.166.19
- tanstack tanstack\/router-devtools-core: 1.167.6; 1.167.9
- tanstack tanstack\/router-generator: 1.166.45; 1.166.48
- tanstack tanstack\/router-plugin: 1.167.38; 1.167.41
- tanstack tanstack\/router-ssr-query-core: 1.168.3; 1.168.6
- tanstack tanstack\/router-utils: 1.161.11; 1.161.14
- tanstack tanstack\/router-vite-plugin: 1.166.53; 1.166.56
- tanstack tanstack\/solid-router: 1.169.5; 1.169.8
- tanstack tanstack\/solid-router-devtools: 1.166.16; 1.166.19
- tanstack tanstack\/solid-router-ssr-query: 1.166.15; 1.166.18
- tanstack tanstack\/solid-start: 1.167.65; 1.167.68
Weakness: CWE-506
Also known as: GHSA-g7cv-rxg3-hmpx
5 references (advisories, patches, write-ups)
- https://github.com/TanStack/router/issues/7383 · Issue Tracking
- https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx · Mitigation, Vendor Advisory
- https://tanstack.com/blog/npm-supply-chain-compromise-postmortem · Exploit, Vendor Advisory
- https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem · Exploit, Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45321 · US Government Resource
Sources: NVD, CVE.org, OSV.dev, FIRST EPSS. Missing ones did not answer or have no record yet.