Skip to content
RequestGuard Vulnerabilities
Pricing

CVE record

CVE-2026-45321

TanStack Unspecified Vulnerability

TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity.

CVE evidence

Known exploitation

Listed in CISA KEV

Absence from the fetched catalog does not establish that exploitation has not occurred.

Severity

critical

CVSS 9.6 · CVSS_V3

Affected packages

42

Supported package records returned by OSV. Vendor and product names are not used to infer matches.

CISA Known Exploited Vulnerabilities

Catalog record

Vendor / project
TanStack
Product
TanStack
Date added
May 27, 2026
CISA federal remediation due date
Jun 10, 2026
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Known ransomware campaign use
Known
CWE
Not supplied

OSV package mapping

Affected open-source packages

PackageEcosystemFixed versions
@tanstack/arktype-adapternpm1.166.16
@tanstack/eslint-plugin-routernpm1.161.13
@tanstack/eslint-plugin-startnpm0.0.8
@tanstack/historynpm1.161.13
@tanstack/nitro-v2-vite-pluginnpm1.154.16
@tanstack/react-routernpm1.169.9
@tanstack/react-router-devtoolsnpm1.166.20
@tanstack/react-router-ssr-querynpm1.166.19
@tanstack/react-startnpm1.167.72
@tanstack/react-start-clientnpm1.166.55
@tanstack/react-start-rscnpm0.0.51
@tanstack/react-start-servernpm1.166.59
@tanstack/router-clinpm1.166.50
@tanstack/router-corenpm1.169.9
@tanstack/router-devtoolsnpm1.166.20
@tanstack/router-devtools-corenpm1.167.10
@tanstack/router-generatornpm1.166.49
@tanstack/router-pluginnpm1.167.42
@tanstack/router-ssr-query-corenpm1.168.7
@tanstack/router-utilsnpm1.161.15
@tanstack/router-vite-pluginnpm1.166.57
@tanstack/solid-routernpm1.169.9
@tanstack/solid-router-devtoolsnpm1.166.20
@tanstack/solid-router-ssr-querynpm1.166.19
@tanstack/solid-startnpm1.167.69
@tanstack/solid-start-clientnpm1.166.54
@tanstack/solid-start-servernpm1.166.58
@tanstack/start-client-corenpm1.168.9
@tanstack/start-fn-stubsnpm1.161.13
@tanstack/start-plugin-corenpm1.169.27
@tanstack/start-server-corenpm1.167.37
@tanstack/start-static-server-functionsnpm1.166.48
@tanstack/start-storage-contextnpm1.166.42
@tanstack/valibot-adapternpm1.166.16
@tanstack/virtual-file-routesnpm1.161.14
@tanstack/vue-routernpm1.169.9
@tanstack/vue-router-devtoolsnpm1.166.20
@tanstack/vue-router-ssr-querynpm1.166.19
@tanstack/vue-startnpm1.167.65
@tanstack/vue-start-clientnpm1.166.50
@tanstack/vue-start-servernpm1.166.54
@tanstack/zod-adapternpm1.166.16