Exploitation evidence
Known exploited · CISA KEV listed
Added 2026-05-27. Ransomware campaign use: Known.
CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date: 2026-06-10. This is the catalog’s deadline, not an assessment of your organization’s exposure.
KEV checked 13 Nov 2026, 00:20 Jerusalem · Original catalog ↗Reported products and versions
@tanstack / arktype-adapter
Default status: Not specified
- affected: 1.166.12
- affected: 1.166.15
@tanstack / eslint-plugin-router
Default status: Not specified
- affected: 1.161.9
- affected: 1.161.12
@tanstack / eslint-plugin-start
Default status: Not specified
- affected: 0.0.4
- affected: 0.0.7
@tanstack / history
Default status: Not specified
- affected: 1.161.9
- affected: 1.161.12
@tanstack / nitro-v2-vite-plugin
Default status: Not specified
- affected: 1.154.12
- affected: 1.154.15
@tanstack / react-router
Default status: Not specified
- affected: 1.169.5
- affected: 1.169.8
@tanstack / react-router-devtools
Default status: Not specified
- affected: 1.166.16
- affected: 1.166.19
@tanstack / react-router-ssr-query
Default status: Not specified
- affected: 1.166.15
- affected: 1.166.18
@tanstack / react-start
Default status: Not specified
- affected: 1.167.68
- affected: 1.167.71
@tanstack / react-start-client
Default status: Not specified
- affected: 1.166.51
- affected: 1.166.54
@tanstack / react-start-rsc
Default status: Not specified
- affected: 0.0.47
- affected: 0.0.50
@tanstack / react-start-server
Default status: Not specified
- affected: 1.166.55
- affected: 1.166.58
@tanstack / router-cli
Default status: Not specified
- affected: 1.166.46
- affected: 1.166.49
@tanstack / router-core
Default status: Not specified
- affected: 1.169.5
- affected: 1.169.8
@tanstack / router-devtools
Default status: Not specified
- affected: 1.166.16
- affected: 1.166.19
@tanstack / router-devtools-core
Default status: Not specified
- affected: 1.167.6
- affected: 1.167.9
@tanstack / router-generator
Default status: Not specified
- affected: 1.166.45
- affected: 1.166.48
@tanstack / router-plugin
Default status: Not specified
- affected: 1.167.38
- affected: 1.167.41
@tanstack / router-ssr-query-core
Default status: Not specified
- affected: 1.168.3
- affected: 1.168.6
@tanstack / router-utils
Default status: Not specified
- affected: 1.161.11
- affected: 1.161.14
@tanstack / outer-vite-plugin
Default status: Not specified
- affected: 1.166.53
- affected: 1.166.56
@tanstack / solid-router
Default status: Not specified
- affected: 1.169.5
- affected: 1.169.8
@tanstack / solid-router-devtools
Default status: Not specified
- affected: 1.166.16
- affected: 1.166.19
@tanstack / solid-router-ssr-query
Default status: Not specified
- affected: 1.166.15
- affected: 1.166.18
@tanstack / solid-start
Default status: Not specified
- affected: 1.167.65
- affected: 1.167.68
@tanstack / solid-start-client
Default status: Not specified
- affected: 1.166.50
- affected: 1.166.53
@tanstack / solid-start-server
Default status: Not specified
- affected: 1.166.54
- affected: 1.166.57
@tanstack / start-client-core
Default status: Not specified
- affected: 1.168.5
- affected: 1.168.8
@tanstack / start-fn-stubs
Default status: Not specified
- affected: 1.161.9
- affected: 1.161.12
@tanstack / start-plugin-core
Default status: Not specified
- affected: 1.169.23
- affected: 1.169.26
@tanstack / start-server-core
Default status: Not specified
- affected: 1.167.33
- affected: 1.167.36
@tanstack / start-static-server-functions
Default status: Not specified
- affected: 1.166.44
- affected: 1.166.47
@tanstack / start-storage-context
Default status: Not specified
- affected: 1.166.38
- affected: 1.166.41
@tanstack / valibot-adapter
Default status: Not specified
- affected: 1.166.12
- affected: 1.166.15
@tanstack / virtual-file-routes
Default status: Not specified
- affected: 1.161.10
- affected: 1.161.13
@tanstack / vue-router
Default status: Not specified
- affected: 1.169.5
- affected: 1.169.8
@tanstack / vue-router-devtools
Default status: Not specified
- affected: 1.166.16
- affected: 1.166.19
@tanstack / vue-router-ssr-query
Default status: Not specified
- affected: 1.166.15
- affected: 1.166.18
@tanstack / vue-start
Default status: Not specified
- affected: 1.167.61
- affected: 1.167.64
@tanstack / vue-start-client
Default status: Not specified
- affected: 1.166.46
- affected: 1.166.49
@tanstack / vue-start-server
Default status: Not specified
- affected: 1.166.50
- affected: 1.166.53
@tanstack / zod-adapter
Default status: Not specified
- affected: 1.166.12
- affected: 1.166.15
Fixes and workarounds
No explicit solution text in the downloaded CVE record. Consult the vendor advisory; unaffected version ranges are shown above as reported, not inferred as a patch recommendation.
Sources and related reporting
CVE Program record ↗ · Download tracked evidence as JSON
- https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx
- https://github.com/TanStack/router/issues/7383
- https://tanstack.com/blog/npm-supply-chain-compromise-postmortem
- https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45321
Observed change timeline
History begins when Egret first downloads each source. It is not the complete upstream CVE history.
12 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-12",
"epss": 0.03278,
"percentile": 0.88603
}10 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-10",
"epss": 0.03278,
"percentile": 0.8853
}09 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-09",
"epss": 0.03278,
"percentile": 0.88515
}08 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-08",
"epss": 0.03278,
"percentile": 0.88508
}07 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-07",
"epss": 0.03278,
"percentile": 0.885
}06 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-06",
"epss": 0.03278,
"percentile": 0.88483
}06 Nov 2026, 06:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-05",
"epss": 0.03278,
"percentile": 0.88473
}04 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-04",
"epss": 0.03278,
"percentile": 0.88463
}03 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-03",
"epss": 0.03278,
"percentile": 0.88442
}03 Nov 2026, 12:20 Jerusalem · CVE Program record changed
Stored CNA snapshot at this observation.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45321",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-27T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-05-27",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45321"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T03:56:09.005Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45321"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-27T00:00:00.000Z",
"value": "CVE-2026-45321 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "arktype-adapter",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.12"
},
{
"status": "affected",
"version": "1.166.15"
}
]
},
{
"product": "eslint-plugin-router",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.161.9"
},
{
"status": "affected",
"version": "1.161.12"
}
]
},
{
"product": "eslint-plugin-start",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "0.0.4"
},
{
"status": "affected",
"version": "0.0.7"
}
]
},
{
"product": "history",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.161.9"
},
{
"status": "affected",
"version": "1.161.12"
}
]
},
{
"product": "nitro-v2-vite-plugin",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.154.12"
},
{
"status": "affected",
"version": "1.154.15"
}
]
},
{
"product": "react-router",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.169.5"
},
{
"status": "affected",
"version": "1.169.8"
}
]
},
{
"product": "react-router-devtools",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.16"
},
{
"status": "affected",
"version": "1.166.19"
}
]
},
{
"product": "react-router-ssr-query",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.15"
},
{
"status": "affected",
"version": "1.166.18"
}
]
},
{
"product": "react-start",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.167.68"
},
{
"status": "affected",
"version": "1.167.71"
}
]
},
{
"product": "react-start-client",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.51"
},
{
"status": "affected",
"version": "1.166.54"
}
]
},
{
"product": "react-start-rsc",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "0.0.47"
},
{
"status": "affected",
"version": "0.0.50"
}
]
},
{
"product": "react-start-server",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.55"
},
{
"status": "affected",
"version": "1.166.58"
}
]
},
{
"product": "router-cli",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.46"
},
{
"status": "affected",
"version": "1.166.49"
}
]
},
{
"product": "router-core",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.169.5"
},
{
"status": "affected",
"version": "1.169.8"
}
]
},
{
"product": "router-devtools",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.16"
},
{
"status": "affected",
"version": "1.166.19"
}
]
},
{
"product": "router-devtools-core",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.167.6"
},
{
"status": "affected",
"version": "1.167.9"
}
]
},
{
"product": "router-generator",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.45"
},
{
"status": "affected",
"version": "1.166.48"
}
]
},
{
"product": "router-plugin",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.167.38"
},
{
"status": "affected",
"version": "1.167.41"
}
]
},
{
"product": "router-ssr-query-core",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.168.3"
},
{
"status": "affected",
"version": "1.168.6"
}
]
},
{
"product": "router-utils",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.161.11"
},
{
"status": "affected",
"version": "1.161.14"
}
]
},
{
"product": "outer-vite-plugin",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.53"
},
{
"status": "affected",
"version": "1.166.56"
}
]
},
{
"product": "solid-router",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.169.5"
},
{
"status": "affected",
"version": "1.169.8"
}
]
},
{
"product": "solid-router-devtools",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.16"
},
{
"status": "affected",
"version": "1.166.19"
}
]
},
{
"product": "solid-router-ssr-query",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.15"
},
{
"status": "affected",
"version": "1.166.18"
}
]
},
{
"product": "solid-start",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.167.65"
},
{
"status": "affected",
"version": "1.167.68"
}
]
},
{
"product": "solid-start-client",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.50"
},
{
"status": "affected",
"version": "1.166.53"
}
]
},
{
"product": "solid-start-server",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.54"
},
{
"status": "affected",
"version": "1.166.57"
}
]
},
{
"product": "start-client-core",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.168.5"
},
{
"status": "affected",
"version": "1.168.8"
}
]
},
{
"product": "start-fn-stubs",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.161.9"
},
{
"status": "affected",
"version": "1.161.12"
}
]
},
{
"product": "start-plugin-core",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.169.23"
},
{
"status": "affected",
"version": "1.169.26"
}
]
},
{
"product": "start-server-core",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.167.33"
},
{
"status": "affected",
"version": "1.167.36"
}
]
},
{
"product": "start-static-server-functions",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.44"
},
{
"status": "affected",
"version": "1.166.47"
}
]
},
{
"product": "start-storage-context",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.38"
},
{
"status": "affected",
"version": "1.166.41"
}
]
},
{
"product": "valibot-adapter",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.12"
},
{
"status": "affected",
"version": "1.166.15"
}
]
},
{
"product": "virtual-file-routes",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.161.10"
},
{
"status": "affected",
"version": "1.161.13"
}
]
},
{
"product": "vue-router",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.169.5"
},
{
"status": "affected",
"version": "1.169.8"
}
]
},
{
"product": "vue-router-devtools",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.16"
},
{
"status": "affected",
"version": "1.166.19"
}
]
},
{
"product": "vue-router-ssr-query",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.15"
},
{
"status": "affected",
"version": "1.166.18"
}
]
},
{
"product": "vue-start",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.167.61"
},
{
"status": "affected",
"version": "1.167.64"
}
]
},
{
"product": "vue-start-client",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.46"
},
{
"status": "affected",
"version": "1.166.49"
}
]
},
{
"product": "vue-start-server",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.50"
},
{
"status": "affected",
"version": "1.166.53"
}
]
},
{
"product": "zod-adapter",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.12"
},
{
"status": "affected",
"version": "1.166.15"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506: Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T15:16:17.354Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx"
},
{
"name": "https://github.com/TanStack/router/issues/7383",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/TanStack/router/issues/7383"
},
{
"name": "https://tanstack.com/blog/npm-supply-chain-compromise-postmortem",
"tags": [
"x_refsource_MISC"
],
"url": "https://tanstack.com/blog/npm-supply-chain-compromise-postmortem"
},
{
"name": "https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem"
}
],
"source": {
"advisory": "GHSA-g7cv-rxg3-hmpx",
"discovery": "UNKNOWN"
},
"title": "Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45321",
"datePublished": "2026-05-12T00:12:35.452Z",
"dateReserved": "2026-05-11T20:50:30.539Z",
"dateUpdated": "2026-08-04T03:56:09.005Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}03 Nov 2026, 02:22 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-02",
"epss": 0.03278,
"percentile": 0.88427
}03 Nov 2026, 02:22 Jerusalem · CISA KEV status changed
Stored KEV snapshot at this observation.
{
"cveID": "CVE-2026-45321",
"cwes": [],
"dateAdded": "2026-05-27",
"dueDate": "2026-06-10",
"forensicTriage": "No",
"knownRansomwareCampaignUse": "Known",
"notes": "This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx ; https://nvd.nist.gov/vuln/detail/CVE-2026-45321",
"product": "TanStack",
"requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
"shortDescription": "TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity.",
"vendorProject": "TanStack",
"vulnerabilityName": "TanStack Unspecified Vulnerability"
}