CRITICAL KEV Used in ransomware campaigns ⚠
Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
Published May 12, 2026 ·Due Jun 10, 2026
9.6
CRITICALCVSS 3.1
EPSS 1.05%
Description
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.
Affected products
- Vendor n/a Product Arktype-Adapter Defaultn/a
- Version 1.166.12StatusaffectedConstraints-
- Version 1.166.15StatusaffectedConstraints-
- Version
- Vendor n/a Product Eslint-Plugin-Router Defaultn/a
- Version 1.161.12StatusaffectedConstraints-
- Version 1.161.9StatusaffectedConstraints-
- Version
- Vendor n/a Product Eslint-Plugin-Start Defaultn/a
- Version 0.0.4StatusaffectedConstraints-
- Version 0.0.7StatusaffectedConstraints-
- Version
- Vendor n/a Product History Defaultn/a
- Version 1.161.12StatusaffectedConstraints-
- Version 1.161.9StatusaffectedConstraints-
- Version
- Vendor n/a Product Nitro-V2-Vite-Plugin Defaultn/a
- Version 1.154.12StatusaffectedConstraints-
- Version 1.154.15StatusaffectedConstraints-
- Version
- Vendor n/a Product Outer-Vite-Plugin Defaultn/a
- Version 1.166.53StatusaffectedConstraints-
- Version 1.166.56StatusaffectedConstraints-
- Version
- Vendor n/a Product React-Router Defaultn/a
- Version 1.169.5StatusaffectedConstraints-
- Version 1.169.8StatusaffectedConstraints-
- Version
- Vendor n/a Product React-Router-Devtools Defaultn/a
- Version 1.166.16StatusaffectedConstraints-
- Version 1.166.19StatusaffectedConstraints-
- Version
- Vendor n/a Product React-Router-Ssr-Query Defaultn/a
- Version 1.166.15StatusaffectedConstraints-
- Version 1.166.18StatusaffectedConstraints-
- Version
- Vendor n/a Product React-Start Defaultn/a
- Version 1.167.68StatusaffectedConstraints-
- Version 1.167.71StatusaffectedConstraints-
- Version
- Vendor n/a Product React-Start-Client Defaultn/a
- Version 1.166.51StatusaffectedConstraints-
- Version 1.166.54StatusaffectedConstraints-
- Version
- Vendor n/a Product React-Start-Rsc Defaultn/a
- Version 0.0.47StatusaffectedConstraints-
- Version 0.0.50StatusaffectedConstraints-
- Version
- Vendor n/a Product React-Start-Server Defaultn/a
- Version 1.166.55StatusaffectedConstraints-
- Version 1.166.58StatusaffectedConstraints-
- Version
- Vendor n/a Product Router-Cli Defaultn/a
- Version 1.166.46StatusaffectedConstraints-
- Version 1.166.49StatusaffectedConstraints-
- Version
- Vendor n/a Product Router-Core Defaultn/a
- Version 1.169.5StatusaffectedConstraints-
- Version 1.169.8StatusaffectedConstraints-
- Version
- Vendor n/a Product Router-Devtools Defaultn/a
- Version 1.166.16StatusaffectedConstraints-
- Version 1.166.19StatusaffectedConstraints-
- Version
- Vendor n/a Product Router-Devtools-Core Defaultn/a
- Version 1.167.6StatusaffectedConstraints-
- Version 1.167.9StatusaffectedConstraints-
- Version
- Vendor n/a Product Router-Generator Defaultn/a
- Version 1.166.45StatusaffectedConstraints-
- Version 1.166.48StatusaffectedConstraints-
- Version
- Vendor n/a Product Router-Plugin Defaultn/a
- Version 1.167.38StatusaffectedConstraints-
- Version 1.167.41StatusaffectedConstraints-
- Version
- Vendor n/a Product Router-Ssr-Query-Core Defaultn/a
- Version 1.168.3StatusaffectedConstraints-
- Version 1.168.6StatusaffectedConstraints-
- Version
- Vendor n/a Product Router-Utils Defaultn/a
- Version 1.161.11StatusaffectedConstraints-
- Version 1.161.14StatusaffectedConstraints-
- Version
- Vendor n/a Product Solid-Router Defaultn/a
- Version 1.169.5StatusaffectedConstraints-
- Version 1.169.8StatusaffectedConstraints-
- Version
- Vendor n/a Product Solid-Router-Devtools Defaultn/a
- Version 1.166.16StatusaffectedConstraints-
- Version 1.166.19StatusaffectedConstraints-
- Version
- Vendor n/a Product Solid-Router-Ssr-Query Defaultn/a
- Version 1.166.15StatusaffectedConstraints-
- Version 1.166.18StatusaffectedConstraints-
- Version
- Vendor n/a Product Solid-Start Defaultn/a
- Version 1.167.65StatusaffectedConstraints-
- Version 1.167.68StatusaffectedConstraints-
- Version
- Vendor n/a Product Solid-Start-Client Defaultn/a
- Version 1.166.50StatusaffectedConstraints-
- Version 1.166.53StatusaffectedConstraints-
- Version
- Vendor n/a Product Solid-Start-Server Defaultn/a
- Version 1.166.54StatusaffectedConstraints-
- Version 1.166.57StatusaffectedConstraints-
- Version
- Vendor n/a Product Start-Client-Core Defaultn/a
- Version 1.168.5StatusaffectedConstraints-
- Version 1.168.8StatusaffectedConstraints-
- Version
- Vendor n/a Product Start-FN-Stubs Defaultn/a
- Version 1.161.12StatusaffectedConstraints-
- Version 1.161.9StatusaffectedConstraints-
- Version
- Vendor n/a Product Start-Plugin-Core Defaultn/a
- Version 1.169.23StatusaffectedConstraints-
- Version 1.169.26StatusaffectedConstraints-
- Version
- Vendor n/a Product Start-Server-Core Defaultn/a
- Version 1.167.33StatusaffectedConstraints-
- Version 1.167.36StatusaffectedConstraints-
- Version
- Vendor n/a Product Start-Static-Server-Functions Defaultn/a
- Version 1.166.44StatusaffectedConstraints-
- Version 1.166.47StatusaffectedConstraints-
- Version
- Vendor n/a Product Start-Storage-Context Defaultn/a
- Version 1.166.38StatusaffectedConstraints-
- Version 1.166.41StatusaffectedConstraints-
- Version
- Vendor n/a Product Valibot-Adapter Defaultn/a
- Version 1.166.12StatusaffectedConstraints-
- Version 1.166.15StatusaffectedConstraints-
- Version
- Vendor n/a Product Virtual-File-Routes Defaultn/a
- Version 1.161.10StatusaffectedConstraints-
- Version 1.161.13StatusaffectedConstraints-
- Version
- Vendor n/a Product Vue-Router Defaultn/a
- Version 1.169.5StatusaffectedConstraints-
- Version 1.169.8StatusaffectedConstraints-
- Version
- Vendor n/a Product Vue-Router-Devtools Defaultn/a
- Version 1.166.16StatusaffectedConstraints-
- Version 1.166.19StatusaffectedConstraints-
- Version
- Vendor n/a Product Vue-Router-Ssr-Query Defaultn/a
- Version 1.166.15StatusaffectedConstraints-
- Version 1.166.18StatusaffectedConstraints-
- Version
- Vendor n/a Product Vue-Start Defaultn/a
- Version 1.167.61StatusaffectedConstraints-
- Version 1.167.64StatusaffectedConstraints-
- Version
- Vendor n/a Product Vue-Start-Client Defaultn/a
- Version 1.166.46StatusaffectedConstraints-
- Version 1.166.49StatusaffectedConstraints-
- Version
- Vendor n/a Product Vue-Start-Server Defaultn/a
- Version 1.166.50StatusaffectedConstraints-
- Version 1.166.53StatusaffectedConstraints-
- Version
- Vendor n/a Product Zod-Adapter Defaultn/a
- Version 1.166.12StatusaffectedConstraints-
- Version 1.166.15StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| n/a | Arktype-Adapter | n/a |
| |||||||||
| n/a | Eslint-Plugin-Router | n/a |
| |||||||||
| n/a | Eslint-Plugin-Start | n/a |
| |||||||||
| n/a | History | n/a |
| |||||||||
| n/a | Nitro-V2-Vite-Plugin | n/a |
| |||||||||
| n/a | Outer-Vite-Plugin | n/a |
| |||||||||
| n/a | React-Router | n/a |
| |||||||||
| n/a | React-Router-Devtools | n/a |
| |||||||||
| n/a | React-Router-Ssr-Query | n/a |
| |||||||||
| n/a | React-Start | n/a |
| |||||||||
| n/a | React-Start-Client | n/a |
| |||||||||
| n/a | React-Start-Rsc | n/a |
| |||||||||
| n/a | React-Start-Server | n/a |
| |||||||||
| n/a | Router-Cli | n/a |
| |||||||||
| n/a | Router-Core | n/a |
| |||||||||
| n/a | Router-Devtools | n/a |
| |||||||||
| n/a | Router-Devtools-Core | n/a |
| |||||||||
| n/a | Router-Generator | n/a |
| |||||||||
| n/a | Router-Plugin | n/a |
| |||||||||
| n/a | Router-Ssr-Query-Core | n/a |
| |||||||||
| n/a | Router-Utils | n/a |
| |||||||||
| n/a | Solid-Router | n/a |
| |||||||||
| n/a | Solid-Router-Devtools | n/a |
| |||||||||
| n/a | Solid-Router-Ssr-Query | n/a |
| |||||||||
| n/a | Solid-Start | n/a |
| |||||||||
| n/a | Solid-Start-Client | n/a |
| |||||||||
| n/a | Solid-Start-Server | n/a |
| |||||||||
| n/a | Start-Client-Core | n/a |
| |||||||||
| n/a | Start-FN-Stubs | n/a |
| |||||||||
| n/a | Start-Plugin-Core | n/a |
| |||||||||
| n/a | Start-Server-Core | n/a |
| |||||||||
| n/a | Start-Static-Server-Functions | n/a |
| |||||||||
| n/a | Start-Storage-Context | n/a |
| |||||||||
| n/a | Valibot-Adapter | n/a |
| |||||||||
| n/a | Virtual-File-Routes | n/a |
| |||||||||
| n/a | Vue-Router | n/a |
| |||||||||
| n/a | Vue-Router-Devtools | n/a |
| |||||||||
| n/a | Vue-Router-Ssr-Query | n/a |
| |||||||||
| n/a | Vue-Start | n/a |
| |||||||||
| n/a | Vue-Start-Client | n/a |
| |||||||||
| n/a | Vue-Start-Server | n/a |
| |||||||||
| n/a | Zod-Adapter | n/a |
|
Configuration 1
OR
- 1.166.12
- 1.166.15
Configuration 2
OR
- 1.161.9
- 1.161.12
Configuration 3
OR
- 0.0.4
- 0.0.7
Configuration 4
OR
- 1.161.9
- 1.161.12
Configuration 5
OR
- 1.154.12
- 1.154.15
Configuration 6
OR
- 1.169.5
- 1.169.8
Configuration 7
OR
- 1.166.16
- 1.166.19
Configuration 8
OR
- 1.166.15
- 1.166.18
Configuration 9
OR
- 1.167.68
- 1.167.71
Configuration 10
OR
- 1.166.51
- 1.166.54
Configuration 11
OR
- 0.0.47
- 0.0.50
Configuration 12
OR
- 1.166.55
- 1.166.58
Configuration 13
OR
- 1.166.46
- 1.166.49
Configuration 14
OR
- 1.169.5
- 1.169.8
Configuration 15
OR
- 1.166.16
- 1.166.19
Configuration 16
OR
- 1.167.6
- 1.167.9
Configuration 17
OR
- 1.166.45
- 1.166.48
Configuration 18
OR
- 1.167.38
- 1.167.41
Configuration 19
OR
- 1.168.3
- 1.168.6
Configuration 20
OR
- 1.161.11
- 1.161.14
Configuration 21
OR
- 1.166.53
- 1.166.56
Configuration 22
OR
- 1.169.5
- 1.169.8
Configuration 23
OR
- 1.166.16
- 1.166.19
Configuration 24
OR
- 1.166.15
- 1.166.18
Configuration 25
OR
- 1.167.65
- 1.167.68
Configuration 26
OR
- 1.166.50
- 1.166.53
Configuration 27
OR
- 1.166.54
- 1.166.57
Configuration 28
OR
- 1.168.5
- 1.168.8
Configuration 29
OR
- 1.161.9
- 1.161.12
Configuration 30
OR
- 1.169.23
- 1.169.26
Configuration 31
OR
- 1.167.33
- 1.167.36
Configuration 32
OR
- 1.166.44
- 1.166.47
Configuration 33
OR
- 1.166.38
- 1.166.41
Configuration 34
OR
- 1.166.12
- 1.166.15
Configuration 35
OR
- 1.161.10
- 1.161.13
Configuration 36
OR
- 1.169.5
- 1.169.8
Configuration 37
OR
- 1.166.16
- 1.166.19
Configuration 38
OR
- 1.166.15
- 1.166.18
Configuration 39
OR
- 1.167.61
- 1.167.64
Configuration 40
OR
- 1.166.46
- 1.166.49
Configuration 41
OR
- 1.166.50
- 1.166.53
Configuration 42
OR
- 1.166.12
- 1.166.15
Configuration 43
OR
- 2.4.6
- 2.2.3
- 2.2.4
- 1.7.2
- 1.7.3
- 1.7.2
- 1.7.3
Configuration 44
OR
- 1.0.4
- 1.0.5
- 1.0.2
- 1.0.3
- 1.0.3
- 1.0.4
Configuration 45
OR
- 0.1.2
- 0.1.3
- 0.1.4
- 0.1.5
- 0.1.6
- 0.1.7
- 0.1.8
- 0.1.9
- 0.1.10
- 0.1.11
- 0.1.12
- 0.1.13
- 0.1.14
- 0.1.15
- 0.1.16
- 0.1.17
- 0.1.19
Configuration 46
OR
- 1.0.8
- 1.0.9
- 1.0.10
- 1.0.12
- 1.3.3
- 1.3.4
- 1.3.5
- 1.3.7
- 0.1.3
- 0.1.4
- 0.1.5
- 0.1.7
- 1.0.2
- 1.0.3
- 1.0.4
- 1.0.6
Configuration 47
OR
- 0.1.3
- 0.1.4
- 0.1.5
- 0.1.6
- 0.1.7
- 0.1.8
Configuration 48
OR
- 0.0.2
- 0.0.3
- 0.0.4
- 0.0.5
- 0.0.6
- 0.0.7
- 0.0.2
- 0.0.3
- 0.0.4
- 0.0.5
- 0.0.6
- 0.0.7
- 0.1.24
- 0.1.25
- 0.1.26
- 0.1.27
- 0.1.28
- 0.1.29
Configuration 49
OR
- 1.0.1
- 1.0.2
- 1.0.3
- 1.0.1
- 1.0.2
- 1.0.3
- 1.0.1
- 1.0.2
- 1.0.3
- 1.0.1
- 1.0.2
- 1.0.3
- 1.0.1
- 1.0.2
- 1.0.3
- 0.2.1
- 0.2.2
- 0.2.3
- 1.0.1
- 1.0.2
- 1.0.3
- 0.1.1
- 0.1.2
- 0.1.3
- 0.2.1
- 0.2.2
- 0.2.3
- 0.2.1
- 0.2.2
- 0.2.3
Configuration 50
OR
- 0.2.1
- 0.2.2
- 0.13.1
- 0.13.2
- 0.24.1
- 0.24.2
- 0.5.1
- 0.5.2
- 0.16.1
- 0.16.2
- 0.8.3
- 0.8.4
Configuration 51
OR
- 1.1.3
- 1.1.4
- 1.1.6
- 0.6.2
- 0.6.3
- 0.6.5
- 0.8.1
- 0.8.2
- 0.8.4
- 0.5.3
- 0.5.4
- 0.5.6
- 0.5.4
- 0.5.5
- 0.5.7
- 0.4.2
- 0.4.3
- 0.4.5
- 0.6.4
- 0.6.5
- 0.6.7
- 0.3.2
- 0.3.3
- 0.3.5
- 0.5.4
- 0.5.5
- 0.5.7
- 0.5.2
- 0.5.3
- 0.5.5
- 0.4.4
- 0.4.5
- 0.4.7
- 0.5.2
- 0.5.3
- 0.5.5
- 0.8.4
- 0.8.5
- 0.8.7
- 0.9.1
- 0.9.2
- 0.9.4
- 0.6.4
- 0.6.5
- 0.6.7
- 0.4.2
- 0.4.3
- 0.4.5
- 0.3.6
- 0.3.7
- 0.3.9
- 0.7.3
- 0.7.4
- 0.7.6
- 0.5.2
- 0.5.3
- 0.5.5
- 0.8.1
- 0.8.2
- 0.8.4
- 0.4.3
- 0.4.4
- 0.4.6
- 0.5.6
- 0.5.7
- 0.5.9
- 3.0.1
- 3.0.2
- 3.0.4
- 0.8.1
- 0.8.2
- 0.8.4
Configuration 52
OR
- 0.1.4
- 0.1.5
- 0.6.2
- 0.6.3
- 0.10.1
- 3.6.2
- 0.28.3
- 0.4.22
- 0.28.3
Configuration 53
OR
- 0.3.1
- 0.3.1
- 0.1.1
- 1.0.2
- 1.0.1
- 0.0.18
- 0.3.1
- 1.5.7
- 1.0.1
- 5.9.2
- 4.24.5
- 2.16.2
- 1.0.1
- 1.0.1
- 1.0.1
- 1.0.1
- 0.1.12
- 1.0.1
- 1.0.1
- 0.1.1
- 1.0.2
- 1.0.1
- 1.0.1
- 1.0.2
- 1.0.1
- 0.3.1
- 0.1.1
- 1.0.1
- 1.0.1
- 1.0.2
- 1.0.2
- 1.0.1
- 1.0.1
- 1.0.1
- 1.0.1
- 0.0.19
- 0.0.9
- 0.0.9
- 0.0.19
- 0.0.19
- 0.1.1
- 1.0.6
- 0.0.16
- 0.0.34
- 1.0.1
- 1.1.16
- 1.0.1
- 0.1.1
- 0.1.11
- 1.3.4
- 1.0.1
- 0.9.5
- 0.0.35
- 1.0.1
- 1.0.11
- 0.0.34
- 1.0.1
- 0.0.7
- 1.0.2
- 0.0.12
- 1.0.1
- 1.0.1
- 1.0.1
- 1.0.1
- 0.1.6
- 1.2.3
No data.
No Red Hat product state for this CVE.
@tanstack/vue-router
npm
Introduced 1.169.5 Fixed 1.169.9@tanstack/vue-router
npm
Introduced 1.169.8 Fixed 1.169.9@tanstack/eslint-plugin-start
npm
Introduced 0.0.4 Fixed 0.0.8@tanstack/eslint-plugin-start
npm
Introduced 0.0.7 Fixed 0.0.8@tanstack/react-start-client
npm
Introduced 1.166.51 Fixed 1.166.55@tanstack/react-start-client
npm
Introduced 1.166.54 Fixed 1.166.55@tanstack/solid-start-server
npm
Introduced 1.166.54 Fixed 1.166.58@tanstack/solid-start-server
npm
Introduced 1.166.57 Fixed 1.166.58@tanstack/start-plugin-core
npm
Introduced 1.169.23 Fixed 1.169.27@tanstack/start-plugin-core
npm
Introduced 1.169.26 Fixed 1.169.27@tanstack/virtual-file-routes
npm
Introduced 1.161.10 Fixed 1.161.14@tanstack/virtual-file-routes
npm
Introduced 1.161.13 Fixed 1.161.14@tanstack/react-router-devtools
npm
Introduced 1.166.16 Fixed 1.166.20@tanstack/react-router-devtools
npm
Introduced 1.166.19 Fixed 1.166.20@tanstack/zod-adapter
npm
Introduced 1.166.12 Fixed 1.166.16@tanstack/zod-adapter
npm
Introduced 1.166.15 Fixed 1.166.16@tanstack/router-utils
npm
Introduced 1.161.11 Fixed 1.161.15@tanstack/router-utils
npm
Introduced 1.161.14 Fixed 1.161.15@tanstack/solid-router
npm
Introduced 1.169.5 Fixed 1.169.9@tanstack/solid-router
npm
Introduced 1.169.8 Fixed 1.169.9@tanstack/solid-router-ssr-query
npm
Introduced 1.166.15 Fixed 1.166.19@tanstack/solid-router-ssr-query
npm
Introduced 1.166.18 Fixed 1.166.19@tanstack/start-server-core
npm
Introduced 1.167.33 Fixed 1.167.37@tanstack/start-server-core
npm
Introduced 1.167.36 Fixed 1.167.37@tanstack/valibot-adapter
npm
Introduced 1.166.12 Fixed 1.166.16@tanstack/valibot-adapter
npm
Introduced 1.166.15 Fixed 1.166.16@tanstack/vue-start
npm
Introduced 1.167.64 Fixed 1.167.65@tanstack/vue-start
npm
Introduced 1.167.61 Fixed 1.167.65@tanstack/arktype-adapter
npm
Introduced 1.166.12 Fixed 1.166.16@tanstack/arktype-adapter
npm
Introduced 1.166.15 Fixed 1.166.16@tanstack/nitro-v2-vite-plugin
npm
Introduced 1.154.15 Fixed 1.154.16@tanstack/nitro-v2-vite-plugin
npm
Introduced 1.154.12 Fixed 1.154.16@tanstack/react-router-ssr-query
npm
Introduced 1.166.18 Fixed 1.166.19@tanstack/react-router-ssr-query
npm
Introduced 1.166.15 Fixed 1.166.19@tanstack/vue-router-ssr-query
npm
Introduced 1.166.15 Fixed 1.166.19@tanstack/vue-router-ssr-query
npm
Introduced 1.166.18 Fixed 1.166.19@tanstack/vue-start-client
npm
Introduced 1.166.46 Fixed 1.166.50@tanstack/vue-start-client
npm
Introduced 1.166.49 Fixed 1.166.50@tanstack/history
npm
Introduced 1.161.9 Fixed 1.161.13@tanstack/history
npm
Introduced 1.161.12 Fixed 1.161.13@tanstack/react-start
npm
Introduced 1.167.68 Fixed 1.167.72@tanstack/react-start
npm
Introduced 1.167.71 Fixed 1.167.72@tanstack/react-start-rsc
npm
Introduced 0.0.47 Fixed 0.0.51@tanstack/react-start-rsc
npm
Introduced 0.0.50 Fixed 0.0.51@tanstack/router-cli
npm
Introduced 1.166.46 Fixed 1.166.50@tanstack/router-cli
npm
Introduced 1.166.49 Fixed 1.166.50@tanstack/router-devtools
npm
Introduced 1.166.16 Fixed 1.166.20@tanstack/router-devtools
npm
Introduced 1.166.19 Fixed 1.166.20@tanstack/router-vite-plugin
npm
Introduced 1.166.53 Fixed 1.166.57@tanstack/router-vite-plugin
npm
Introduced 1.166.56 Fixed 1.166.57@tanstack/solid-start-client
npm
Introduced 1.166.50 Fixed 1.166.54@tanstack/solid-start-client
npm
Introduced 1.166.53 Fixed 1.166.54@tanstack/start-static-server-functions
npm
Introduced 1.166.44 Fixed 1.166.48@tanstack/start-static-server-functions
npm
Introduced 1.166.47 Fixed 1.166.48@tanstack/react-router
npm
Introduced 1.169.5 Fixed 1.169.9@tanstack/react-router
npm
Introduced 1.169.8 Fixed 1.169.9@tanstack/react-start-server
npm
Introduced 1.166.55 Fixed 1.166.59@tanstack/react-start-server
npm
Introduced 1.166.58 Fixed 1.166.59@tanstack/router-plugin
npm
Introduced 1.167.38 Fixed 1.167.42@tanstack/router-plugin
npm
Introduced 1.167.41 Fixed 1.167.42@tanstack/solid-router-devtools
npm
Introduced 1.166.19 Fixed 1.166.20@tanstack/solid-router-devtools
npm
Introduced 1.166.16 Fixed 1.166.20@tanstack/vue-router-devtools
npm
Introduced 1.166.16 Fixed 1.166.20@tanstack/vue-router-devtools
npm
Introduced 1.166.19 Fixed 1.166.20@tanstack/router-core
npm
Introduced 1.169.5 Fixed 1.169.9@tanstack/router-core
npm
Introduced 1.169.8 Fixed 1.169.9@tanstack/router-generator
npm
Introduced 1.166.45 Fixed 1.166.49@tanstack/router-generator
npm
Introduced 1.166.48 Fixed 1.166.49@tanstack/vue-start-server
npm
Introduced 1.166.50 Fixed 1.166.54@tanstack/vue-start-server
npm
Introduced 1.166.53 Fixed 1.166.54@tanstack/eslint-plugin-router
npm
Introduced 1.161.9 Fixed 1.161.13@tanstack/eslint-plugin-router
npm
Introduced 1.161.12 Fixed 1.161.13@tanstack/router-devtools-core
npm
Introduced 1.167.6 Fixed 1.167.10@tanstack/router-devtools-core
npm
Introduced 1.167.9 Fixed 1.167.10@tanstack/router-ssr-query-core
npm
Introduced 1.168.3 Fixed 1.168.7@tanstack/router-ssr-query-core
npm
Introduced 1.168.6 Fixed 1.168.7@tanstack/solid-start
npm
Introduced 1.167.65 Fixed 1.167.69@tanstack/solid-start
npm
Introduced 1.167.68 Fixed 1.167.69@tanstack/start-client-core
npm
Introduced 1.168.5 Fixed 1.168.9@tanstack/start-client-core
npm
Introduced 1.168.8 Fixed 1.168.9@tanstack/start-fn-stubs
npm
Introduced 1.161.9 Fixed 1.161.13@tanstack/start-fn-stubs
npm
Introduced 1.161.12 Fixed 1.161.13@tanstack/start-storage-context
npm
Introduced 1.166.38 Fixed 1.166.42@tanstack/start-storage-context
npm
Introduced 1.166.41 Fixed 1.166.42
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @tanstack/vue-router | 1.169.5 | 1.169.9 |
| npm | @tanstack/vue-router | 1.169.8 | 1.169.9 |
| npm | @tanstack/eslint-plugin-start | 0.0.4 | 0.0.8 |
| npm | @tanstack/eslint-plugin-start | 0.0.7 | 0.0.8 |
| npm | @tanstack/react-start-client | 1.166.51 | 1.166.55 |
| npm | @tanstack/react-start-client | 1.166.54 | 1.166.55 |
| npm | @tanstack/solid-start-server | 1.166.54 | 1.166.58 |
| npm | @tanstack/solid-start-server | 1.166.57 | 1.166.58 |
| npm | @tanstack/start-plugin-core | 1.169.23 | 1.169.27 |
| npm | @tanstack/start-plugin-core | 1.169.26 | 1.169.27 |
| npm | @tanstack/virtual-file-routes | 1.161.10 | 1.161.14 |
| npm | @tanstack/virtual-file-routes | 1.161.13 | 1.161.14 |
| npm | @tanstack/react-router-devtools | 1.166.16 | 1.166.20 |
| npm | @tanstack/react-router-devtools | 1.166.19 | 1.166.20 |
| npm | @tanstack/zod-adapter | 1.166.12 | 1.166.16 |
| npm | @tanstack/zod-adapter | 1.166.15 | 1.166.16 |
| npm | @tanstack/router-utils | 1.161.11 | 1.161.15 |
| npm | @tanstack/router-utils | 1.161.14 | 1.161.15 |
| npm | @tanstack/solid-router | 1.169.5 | 1.169.9 |
| npm | @tanstack/solid-router | 1.169.8 | 1.169.9 |
| npm | @tanstack/solid-router-ssr-query | 1.166.15 | 1.166.19 |
| npm | @tanstack/solid-router-ssr-query | 1.166.18 | 1.166.19 |
| npm | @tanstack/start-server-core | 1.167.33 | 1.167.37 |
| npm | @tanstack/start-server-core | 1.167.36 | 1.167.37 |
| npm | @tanstack/valibot-adapter | 1.166.12 | 1.166.16 |
| npm | @tanstack/valibot-adapter | 1.166.15 | 1.166.16 |
| npm | @tanstack/vue-start | 1.167.64 | 1.167.65 |
| npm | @tanstack/vue-start | 1.167.61 | 1.167.65 |
| npm | @tanstack/arktype-adapter | 1.166.12 | 1.166.16 |
| npm | @tanstack/arktype-adapter | 1.166.15 | 1.166.16 |
| npm | @tanstack/nitro-v2-vite-plugin | 1.154.15 | 1.154.16 |
| npm | @tanstack/nitro-v2-vite-plugin | 1.154.12 | 1.154.16 |
| npm | @tanstack/react-router-ssr-query | 1.166.18 | 1.166.19 |
| npm | @tanstack/react-router-ssr-query | 1.166.15 | 1.166.19 |
| npm | @tanstack/vue-router-ssr-query | 1.166.15 | 1.166.19 |
| npm | @tanstack/vue-router-ssr-query | 1.166.18 | 1.166.19 |
| npm | @tanstack/vue-start-client | 1.166.46 | 1.166.50 |
| npm | @tanstack/vue-start-client | 1.166.49 | 1.166.50 |
| npm | @tanstack/history | 1.161.9 | 1.161.13 |
| npm | @tanstack/history | 1.161.12 | 1.161.13 |
| npm | @tanstack/react-start | 1.167.68 | 1.167.72 |
| npm | @tanstack/react-start | 1.167.71 | 1.167.72 |
| npm | @tanstack/react-start-rsc | 0.0.47 | 0.0.51 |
| npm | @tanstack/react-start-rsc | 0.0.50 | 0.0.51 |
| npm | @tanstack/router-cli | 1.166.46 | 1.166.50 |
| npm | @tanstack/router-cli | 1.166.49 | 1.166.50 |
| npm | @tanstack/router-devtools | 1.166.16 | 1.166.20 |
| npm | @tanstack/router-devtools | 1.166.19 | 1.166.20 |
| npm | @tanstack/router-vite-plugin | 1.166.53 | 1.166.57 |
| npm | @tanstack/router-vite-plugin | 1.166.56 | 1.166.57 |
| npm | @tanstack/solid-start-client | 1.166.50 | 1.166.54 |
| npm | @tanstack/solid-start-client | 1.166.53 | 1.166.54 |
| npm | @tanstack/start-static-server-functions | 1.166.44 | 1.166.48 |
| npm | @tanstack/start-static-server-functions | 1.166.47 | 1.166.48 |
| npm | @tanstack/react-router | 1.169.5 | 1.169.9 |
| npm | @tanstack/react-router | 1.169.8 | 1.169.9 |
| npm | @tanstack/react-start-server | 1.166.55 | 1.166.59 |
| npm | @tanstack/react-start-server | 1.166.58 | 1.166.59 |
| npm | @tanstack/router-plugin | 1.167.38 | 1.167.42 |
| npm | @tanstack/router-plugin | 1.167.41 | 1.167.42 |
| npm | @tanstack/solid-router-devtools | 1.166.19 | 1.166.20 |
| npm | @tanstack/solid-router-devtools | 1.166.16 | 1.166.20 |
| npm | @tanstack/vue-router-devtools | 1.166.16 | 1.166.20 |
| npm | @tanstack/vue-router-devtools | 1.166.19 | 1.166.20 |
| npm | @tanstack/router-core | 1.169.5 | 1.169.9 |
| npm | @tanstack/router-core | 1.169.8 | 1.169.9 |
| npm | @tanstack/router-generator | 1.166.45 | 1.166.49 |
| npm | @tanstack/router-generator | 1.166.48 | 1.166.49 |
| npm | @tanstack/vue-start-server | 1.166.50 | 1.166.54 |
| npm | @tanstack/vue-start-server | 1.166.53 | 1.166.54 |
| npm | @tanstack/eslint-plugin-router | 1.161.9 | 1.161.13 |
| npm | @tanstack/eslint-plugin-router | 1.161.12 | 1.161.13 |
| npm | @tanstack/router-devtools-core | 1.167.6 | 1.167.10 |
| npm | @tanstack/router-devtools-core | 1.167.9 | 1.167.10 |
| npm | @tanstack/router-ssr-query-core | 1.168.3 | 1.168.7 |
| npm | @tanstack/router-ssr-query-core | 1.168.6 | 1.168.7 |
| npm | @tanstack/solid-start | 1.167.65 | 1.167.69 |
| npm | @tanstack/solid-start | 1.167.68 | 1.167.69 |
| npm | @tanstack/start-client-core | 1.168.5 | 1.168.9 |
| npm | @tanstack/start-client-core | 1.168.8 | 1.168.9 |
| npm | @tanstack/start-fn-stubs | 1.161.9 | 1.161.13 |
| npm | @tanstack/start-fn-stubs | 1.161.12 | 1.161.13 |
| npm | @tanstack/start-storage-context | 1.166.38 | 1.166.42 |
| npm | @tanstack/start-storage-context | 1.166.41 | 1.166.42 |
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
9.6 CRITICAL GHSA
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Changed
Confidentiality Impact High
Integrity Impact High
Availability Impact High
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
Listed in CISA KEV KEV Used in ransomware campaigns ⚠
Date Added
May 27, 2026
Patch Due
Jun 10, 2026
Required Action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
ActiveAutomatable
NoTechnical Impact
TotalDecision
n/aAssessed May 27, 2026 · SSVC 2.0.3
1.05% 0.01054
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
EPSS probability 0.01054
Score over time
May–Oct 2026- EPSS v4
- EPSS v5
Percentile over time
- EPSS v4
- EPSS v5
Table of values (7 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 1.05% (0.01054) | 63.11th | v5 (v2026.06.15) |
| Sep 20, 2026 | 2.34% (0.02342) | 82.87th | v5 (v2026.06.15) |
| Jun 15, 2026 | 1.60% (0.01601) | 72.56th | v5 (v2026.06.15) |
| Jun 13, 2026 | 18.23% (0.18235) | 95.37th | v4 (v2025.03.14) |
| May 30, 2026 | 17.05% (0.17051) | 95.10th | v4 (v2025.03.14) |
| May 28, 2026 | 15.09% (0.15085) | 94.68th | v4 (v2025.03.14) |
| May 12, 2026 | 0.04% (0.00041) | 12.35th | v4 (v2025.03.14) |
Weaknesses (1)
References (8)
- https://github.com/TanStack/router/issues/7383 x_refsource_MISCIssue Tracking
- https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx x_refsource_CONFIRMMitigationVendor Advisory
- https://github.com/advisories/GHSA-g7cv-rxg3-hmpx Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-45321
- https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
- https://tanstack.com/blog/npm-supply-chain-compromise-postmortem x_refsource_MISCExploitVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45321 government-resourceUS Government Resource
- https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem x_refsource_MISCExploitThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| https://github.com/TanStack/router/issues/7383 | x_refsource_MISCIssue Tracking | |
| https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx | x_refsource_CONFIRMMitigationVendor Advisory | |
| https://github.com/advisories/GHSA-g7cv-rxg3-hmpx | Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2026-45321 | ||
| https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack | ||
| https://tanstack.com/blog/npm-supply-chain-compromise-postmortem | x_refsource_MISCExploitVendor Advisory | |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45321 | government-resourceUS Government Resource | |
| https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem | x_refsource_MISCExploitThird Party Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner GitHub_M
Published May 12, 2026
Updated Aug 4, 2026
Reserved May 11, 2026
Link CVE-2026-45321
CISA Vulnrichment
GHSA-G7CV-RXG3-HMPX Updated May 27, 2026