NetSight
IP …
critical9.6Known exploited

CVE-2026-45321

Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

Exploited in the wild

This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2026-05-27. Federal due date: 2026-06-10.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Impact

TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity.

Affected packages

EcosystemPackageAffectedFixed in
npm@tanstack/arktype-adapter= 1.166.121.166.16
npm@tanstack/eslint-plugin-router= 1.161.91.161.13
npm@tanstack/eslint-plugin-start= 0.0.40.0.8
npm@tanstack/history= 1.161.91.161.13
npm@tanstack/nitro-v2-vite-plugin= 1.154.121.154.16
npm@tanstack/react-router= 1.169.51.169.9
npm@tanstack/react-router-devtools= 1.166.161.166.20
npm@tanstack/react-router-ssr-query= 1.166.151.166.19
npm@tanstack/react-start= 1.167.681.167.72
npm@tanstack/react-start-client= 1.166.511.166.55
npm@tanstack/react-start-rsc= 0.0.470.0.51
npm@tanstack/react-start-server= 1.166.551.166.59
npm@tanstack/router-cli= 1.166.461.166.50
npm@tanstack/router-core= 1.169.51.169.9
npm@tanstack/router-devtools= 1.166.161.166.20
npm@tanstack/router-devtools-core= 1.167.61.167.10
npm@tanstack/router-generator= 1.166.451.166.49
npm@tanstack/router-plugin= 1.167.381.167.42
npm@tanstack/router-ssr-query-core= 1.168.31.168.7
npm@tanstack/router-utils= 1.161.111.161.15
npm@tanstack/router-vite-plugin= 1.166.531.166.57
npm@tanstack/solid-router= 1.169.51.169.9
npm@tanstack/solid-router-devtools= 1.166.161.166.20
npm@tanstack/solid-router-ssr-query= 1.166.151.166.19
npm@tanstack/solid-start= 1.167.651.167.69
npm@tanstack/solid-start-client= 1.166.501.166.54
npm@tanstack/solid-start-server= 1.166.541.166.58
npm@tanstack/start-client-core= 1.168.51.168.9
npm@tanstack/start-fn-stubs= 1.161.91.161.13
npm@tanstack/start-plugin-core= 1.169.231.169.27
npm@tanstack/start-server-core= 1.167.331.167.37
npm@tanstack/start-static-server-functions= 1.166.441.166.48
npm@tanstack/start-storage-context= 1.166.381.166.42
npm@tanstack/valibot-adapter= 1.166.121.166.16
npm@tanstack/virtual-file-routes= 1.161.101.161.14
npm@tanstack/vue-router= 1.169.51.169.9
npm@tanstack/vue-router-devtools= 1.166.161.166.20
npm@tanstack/vue-router-ssr-query= 1.166.151.166.19
npm@tanstack/vue-start= 1.167.611.167.65
npm@tanstack/vue-start-client= 1.166.461.166.50
npm@tanstack/vue-start-server= 1.166.501.166.54
npm@tanstack/zod-adapter= 1.166.121.166.16

Affected products

VendorProductAffected versions
TanstackTanstack\/Arktype-Adapter
Versions 1.166.12, 1.166.15
TanstackTanstack\/Eslint-Plugin-Router
Versions 1.161.9, 1.161.12
TanstackTanstack\/Eslint-Plugin-Start
Versions 0.0.4, 0.0.7
TanstackTanstack\/History
Versions 1.161.9, 1.161.12
TanstackTanstack\/Nitro-V2-Vite-Plugin
Versions 1.154.12, 1.154.15
TanstackTanstack\/React-Router
Versions 1.169.5, 1.169.8
TanstackTanstack\/React-Router-Devtools
Versions 1.166.16, 1.166.19
TanstackTanstack\/React-Router-Ssr-Query
Versions 1.166.15, 1.166.18
TanstackTanstack\/React-Start
Versions 1.167.68, 1.167.71
TanstackTanstack\/React-Start-Client
Versions 1.166.51, 1.166.54
TanstackTanstack\/React-Start-Rsc
Versions 0.0.47, 0.0.50
TanstackTanstack\/React-Start-Server
Versions 1.166.55, 1.166.58

Weakness classification

CWE-506

References