CVE-2026-45321: TanStack Unspecified Vulnerability

Patch now

CRITICAL 9.6EXPLOITEDDOWNGRADEDOWNGRADEDOWNGRADE

CVE-2026-45321 is a critical-severity flaw (CVSS 9.6) affecting tanstack\/arktype-adapter, tanstack\/eslint-plugin-router, tanstack\/eslint-plugin-start, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache po

Why this priority

Critical severity
Exploited in the wild (CISA KEV)
Used in ransomware campaigns
Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score	9.6 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	Required
EPSS exploit chance	3.3% (top 12%)
CISA exploited list	Yes, fix due 2026-06-10, used in ransomware
Weakness	CWE-506
Published	2026-05-12
Last modified	2026-10-26

Publisher (CNA): GitHub, Inc. · Vendor: tanstack

Last updated 2026-10-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-05-12 01:16 UTCPublished CVE record published
2026-05-27Exploited Added to the CISA Known Exploited Vulnerabilities list
2026-06-10Deadline CISA due date for US federal agencies to patch
2026-10-26 18:10 UTCUpdated Record last modified

tanstack tanstack\/arktype-adapter DOWNGRADE

Affected: 1.166.12 · 1.166.15

Fixed in: no fixed release known

Safe to downgrade to: a release before 1.166.12

1. Check installed version

npm ls tanstackarktype-adapter

2. No fixed release: DOWNGRADE to a release before 1.166.12

npm view tanstackarktype-adapter versions npm install tanstackarktype-adapter@"<1.166.12"

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

tanstack tanstack\/eslint-plugin-router DOWNGRADE

Affected: 1.161.9 · 1.161.12

Fixed in: no fixed release known

Safe to downgrade to: a release before 1.161.9

1. Check installed version

npm ls tanstackeslint-plugin-router

2. No fixed release: DOWNGRADE to a release before 1.161.9

npm view tanstackeslint-plugin-router versions npm install tanstackeslint-plugin-router@"<1.161.9"

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

tanstack tanstack\/eslint-plugin-start DOWNGRADE

Affected: 0.0.4 · 0.0.7

Fixed in: no fixed release known

Safe to downgrade to: a release before 0.0.4

1. Check installed version

npm ls tanstackeslint-plugin-start

2. No fixed release: DOWNGRADE to a release before 0.0.4

npm view tanstackeslint-plugin-start versions npm install tanstackeslint-plugin-start@"<0.0.4"

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

tanstack tanstack\/history DOWNGRADE

Affected: 1.161.9 · 1.161.12

Fixed in: no fixed release known

Safe to downgrade to: a release before 1.161.9

1. Check installed version

npm ls tanstackhistory

2. No fixed release: DOWNGRADE to a release before 1.161.9

npm view tanstackhistory versions npm install tanstackhistory@"<1.161.9"

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

tanstack tanstack\/nitro-v2-vite-plugin DOWNGRADE

Affected: 1.154.12 · 1.154.15

Fixed in: no fixed release known

Safe to downgrade to: a release before 1.154.12

1. Check installed version

npm ls tanstacknitro-v2-vite-plugin

2. No fixed release: DOWNGRADE to a release before 1.154.12

npm view tanstacknitro-v2-vite-plugin versions npm install tanstacknitro-v2-vite-plugin@"<1.154.12"

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

tanstack tanstack\/react-router DOWNGRADE

Affected: 1.169.5 · 1.169.8

Fixed in: no fixed release known

Safe to downgrade to: a release before 1.169.5

1. Check installed version

npm ls tanstackreact-router

2. No fixed release: DOWNGRADE to a release before 1.169.5

npm view tanstackreact-router versions npm install tanstackreact-router@"<1.169.5"

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

A distro patch exists: prefer upgrading over downgrading.

npm · @tanstack/arktype-adapter · FIXED · 1.166.16 · vulnerable: = 1.166.12 · source

npm install @tanstack/arktype-adapter@">=1.166.16" npm ls @tanstack/arktype-adapter

npm · @tanstack/eslint-plugin-router · FIXED · 1.161.13 · vulnerable: = 1.161.9 · source

npm install @tanstack/eslint-plugin-router@">=1.161.13" npm ls @tanstack/eslint-plugin-router

npm · @tanstack/eslint-plugin-start · FIXED · 0.0.8 · vulnerable: = 0.0.4 · source

npm install @tanstack/eslint-plugin-start@">=0.0.8" npm ls @tanstack/eslint-plugin-start

npm · @tanstack/history · FIXED · 1.161.13 · vulnerable: = 1.161.9 · source

npm install @tanstack/history@">=1.161.13" npm ls @tanstack/history

npm · @tanstack/nitro-v2-vite-plugin · FIXED · 1.154.16 · vulnerable: = 1.154.12 · source

npm install @tanstack/nitro-v2-vite-plugin@">=1.154.16" npm ls @tanstack/nitro-v2-vite-plugin

npm · @tanstack/react-router · FIXED · 1.169.9 · vulnerable: = 1.169.5 · source

npm install @tanstack/react-router@">=1.169.9" npm ls @tanstack/react-router

Fedora ELN · xfsdump · FIXED · 3.3.0-3.eln159 · FEDORA-2026-6e9bb3f901 · source

sudo dnf upgrade --advisory=FEDORA-2026-6e9bb3f901

Fedora 46 · fio · FIXED · 3.43-2.fc46 · FEDORA-2026-b36219886b · source

sudo dnf upgrade --advisory=FEDORA-2026-b36219886b

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

GitHub PoC: Intrudify/mini-shai-hulud-scanner (3 stars)
GitHub PoC: fabriziosalmi/tanstack-compromise-checker (2 stars)
GitHub PoC: qi-scape/scan-shai-hulud (1 stars)

Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-45321?

tanstack\/arktype-adapter: downgrade or apply the listed mitigation; tanstack\/eslint-plugin-router: downgrade or apply the listed mitigation; tanstack\/eslint-plugin-start: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2026-45321 being exploited?

Yes. CVE-2026-45321 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

What does CVE-2026-45321 affect?

CVE-2026-45321 affects tanstack\/arktype-adapter, tanstack\/eslint-plugin-router, tanstack\/eslint-plugin-start. Severity is critical (CVSS 9.6). On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher bin

How urgent is CVE-2026-45321?

Priority 91/100. Critical severity; Exploited in the wild (CISA KEV); Used in ransomware campaigns; Public exploit reference

Software pages

React vulnerabilities · GitHub vulnerabilities

References

← Back to latest CVEs