CVE-2026-45321TanStack Unspecified Vulnerability
CISA Known Exploited Vulnerabilities Data
Description
TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity.
Required Action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA Due Date
June 10, 2026 (federal agency requirement)
Known Ransomware Campaign Use
Known — this CVE has been associated with ransomware campaigns.
Notes
This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx ; https://nvd.nist.gov/vuln/detail/CVE-2026-45321
External References
Concerned about this vulnerability in your environment?
Our team can assess your exposure and help you remediate.
Data sourced from the CISA Known Exploited Vulnerabilities catalog. CISA does not endorse any commercial product or service.