CVE-2026-45321
TanStack Unspecified Vulnerability
Description
CVE-2026-45321 is a critical supply chain vulnerability affecting TanStack, in which embedded malicious code was published to the npm registry. On 2026-05-11, an attacker published 84 malicious versions across 42 @tanstack/* packages — including widely used packages such as @tanstack/react-router and @tanstack/router-core — by abusing TanStack's trusted-publisher binding. Developers who installed an affected version pulled credential-stealing malware into their projects, putting tokens, secrets and build pipelines at risk. With a CVSS score of 9.6, a CISA KEV listing, and association with ransomware-style self-spreading attacks, CVE-2026-45321 demands immediate auditing and remediation of any project that consumed @tanstack/* packages around that date.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| tanstack | tanstack\/arktype-adapter | 1.166.12; 1.166.15 |
| tanstack | tanstack\/eslint-plugin-router | 1.161.9; 1.161.12 |
| tanstack | tanstack\/eslint-plugin-start | 0.0.4; 0.0.7 |
| tanstack | tanstack\/history | 1.161.9; 1.161.12 |
| tanstack | tanstack\/nitro-v2-vite-plugin | 1.154.12; 1.154.15 |
| tanstack | tanstack\/react-router | 1.169.5; 1.169.8 |
| tanstack | tanstack\/react-router-devtools | 1.166.16; 1.166.19 |
| tanstack | tanstack\/react-router-ssr-query | 1.166.15; 1.166.18 |
| tanstack | tanstack\/react-start | 1.167.68; 1.167.71 |
| tanstack | tanstack\/react-start-client | 1.166.51; 1.166.54 |
| tanstack | tanstack\/react-start-rsc | 0.0.47; 0.0.50 |
| tanstack | tanstack\/react-start-server | 1.166.55; 1.166.58 |
| tanstack | tanstack\/router-cli | 1.166.46; 1.166.49 |
| tanstack | tanstack\/router-core | 1.169.5; 1.169.8 |
| tanstack | tanstack\/router-devtools | 1.166.16; 1.166.19 |
| tanstack | tanstack\/router-devtools-core | 1.167.6; 1.167.9 |
| tanstack | tanstack\/router-generator | 1.166.45; 1.166.48 |
| tanstack | tanstack\/router-plugin | 1.167.38; 1.167.41 |
| tanstack | tanstack\/router-ssr-query-core | 1.168.3; 1.168.6 |
| tanstack | tanstack\/router-utils | 1.161.11; 1.161.14 |
References
- https://github.com/TanStack/router/issues/7383(Issue Tracking)
- https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx(Mitigation, Vendor Advisory)
- https://tanstack.com/blog/npm-supply-chain-compromise-postmortem(Exploit, Vendor Advisory)
- https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45321(US Government Resource)
Weakness Type
CWE-506: Embedded Malicious Code
Embedded malicious code is hostile logic intentionally introduced into otherwise legitimate software. In CVE-2026-45321 the attacker published trojanized versions of trusted @tanstack/* packages to npm, so the malicious code was delivered as a normal dependency and executed within the build and runtime context of every project that installed it.
Learn more: CWE-506 — Embedded Malicious Code
Impact Analysis
CVE-2026-45321 carries a CVSS 3.1 score of 9.6 (CRITICAL). The CVSS vector marks the attack as remotely exploitable (Attack Vector: Network), low-complexity (Attack Complexity: Low) and requiring no privileges (Privileges Required: None); user interaction is required (User Interaction: Required) in the sense that a developer must install or update to an affected package version, and crucially the scope is changed (Scope: Changed) — the malicious code can affect resources beyond the package itself, reaching the developer's broader environment, CI/CD systems and downstream artifacts. Confidentiality, integrity and availability impacts are all High: the malware was designed to steal credentials and could tamper with or disrupt affected projects. The EPSS score of 15.1% sits in the 94.7th percentile, and CISA has flagged the entry as associated with ransomware-style, self-spreading supply chain activity, making the blast radius potentially far larger than a single project.
Exploit Maturity
CVE-2026-45321 is an actively realized supply chain attack rather than a theoretical flaw. The 84 malicious package versions were published to npm and consumed by real installations, and CISA has added the CVE to its Known Exploited Vulnerabilities catalog and flagged it as associated with ransomware. The vendor postmortem is published at tanstack.com and a third-party analysis describing the self-spreading "mini Shai-Hulud" campaign is available from StepSecurity; both are tagged as exploit references. With an EPSS score of 15.1% (94.7th percentile) and confirmed in-the-wild distribution, any project that installed an affected @tanstack/* version should be treated as compromised and investigated immediately.
Remediation
- Apply mitigations per vendor instructions as mandated by the CISA KEV deadline of 2026-06-10, and follow the vendor security advisory GHSA-g7cv-rxg3-hmpx.
- Identify and remove the malicious versions from your dependency tree and lockfiles — each affected package received exactly two malicious versions published minutes apart (for example @tanstack/react-router 1.169.5 and 1.169.8) — and pin to known-good releases published outside the 2026-05-11 compromise window.
- Treat any environment that installed an affected version as compromised: rotate all credentials, npm/CI tokens, cloud secrets and signing keys that were reachable from the build, and clear and rebuild dependency caches.
- Hunt for indicators of compromise across CI/CD logs and repositories — unauthorized package publishes, exfiltration of tokens, and self-propagation to other packages you maintain — using the IOCs in the vendor and StepSecurity reports.
- As long-term hardening against embedded malicious code, enforce lockfile integrity, require provenance/signature verification for dependencies, scope trusted-publisher and OIDC bindings tightly, and review pull_request_target and CI cache trust boundaries that this attack abused.
Technical Details
CVE-2026-45321 is embedded malicious code (CWE-506) delivered through the npm supply chain. Between approximately 19:20 and 19:26 UTC on 2026-05-11, 84 malicious versions across 42 @tanstack/* packages were published. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, even though the publish workflow itself was not modified: the attacker chained a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork-to-base trust boundary, and runtime extraction of the OIDC token from the Actions runner process to publish credential-stealing malware under a trusted identity. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) captures the key properties — network-delivered, low-complexity, no privileges, requires the victim to install the package, and with changed scope reflecting impact beyond the package boundary into the developer's environment.
Frequently Asked Questions
Is CVE-2026-45321 being actively exploited?
Yes. CVE-2026-45321 is a realized npm supply chain compromise: 84 malicious @tanstack/* versions were published and installed by real users. CISA has listed it on the Known Exploited Vulnerabilities catalog and flagged it as associated with ransomware, and its EPSS score of 15.1% (94.7th percentile) indicates high exploitation likelihood.
What products are affected by CVE-2026-45321?
42 @tanstack/* npm packages received two malicious versions each on 2026-05-11, including @tanstack/react-router (1.169.5, 1.169.8), @tanstack/router-core (1.169.5, 1.169.8), @tanstack/react-start, @tanstack/router-plugin and many others. Only those specific malicious versions are affected.
How do I fix CVE-2026-45321?
Remove the malicious versions from your dependency tree and lockfiles, pin to clean releases published outside the 2026-05-11 window, and follow the TanStack advisory. Because the malware stole credentials, also rotate all tokens and secrets reachable from any affected build.
How severe is CVE-2026-45321?
CVE-2026-45321 is rated CRITICAL with a CVSS 3.1 score of 9.6. It delivered credential-stealing code into developer environments with high confidentiality, integrity and availability impact and a changed scope, is confirmed exploited by CISA, and is associated with self-spreading ransomware-style activity — making it an urgent remediation priority.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.