9.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45321

CVE-2026-45321: Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45321

CVE-2026-45321:

9.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@tanstack/arktype-adapter	npm	= 1.166.12	1.166.16
@tanstack/eslint-plugin-router	npm	= 1.161.9	1.161.13
@tanstack/eslint-plugin-start	npm	= 0.0.4	0.0.8
@tanstack/history	npm	= 1.161.9	1.161.13
@tanstack/nitro-v2-vite-plugin	npm	= 1.154.12	1.154.16
@tanstack/react-router	npm	= 1.169.5	1.169.9
@tanstack/react-router-devtools	npm	= 1.166.16	1.166.20
@tanstack/react-router-ssr-query	npm	= 1.166.15	1.166.19
@tanstack/react-start	npm	= 1.167.68	1.167.72
@tanstack/react-start-client	npm	= 1.166.51	1.166.55
@tanstack/react-start-rsc	npm	= 0.0.47	0.0.51
@tanstack/react-start-server	npm	= 1.166.55	1.166.59
@tanstack/router-cli	npm	= 1.166.46	1.166.50
@tanstack/router-core	npm	= 1.169.5	1.169.9
@tanstack/router-devtools	npm	= 1.166.16	1.166.20
@tanstack/router-devtools-core	npm	= 1.167.6	1.167.10
@tanstack/router-generator	npm	= 1.166.45	1.166.49
@tanstack/router-plugin	npm	= 1.167.38	1.167.42
@tanstack/router-ssr-query-core	npm	= 1.168.3	1.168.7
@tanstack/router-utils	npm	= 1.161.11	1.161.15
@tanstack/router-vite-plugin	npm	= 1.166.53	1.166.57
@tanstack/solid-router	npm	= 1.169.5	1.169.9
@tanstack/solid-router-devtools	npm	= 1.166.16	1.166.20
@tanstack/solid-router-ssr-query	npm	= 1.166.15	1.166.19
@tanstack/solid-start	npm	= 1.167.65	1.167.69
@tanstack/solid-start-client	npm	= 1.166.50	1.166.54
@tanstack/solid-start-server	npm	= 1.166.54	1.166.58
@tanstack/start-client-core	npm	= 1.168.5	1.168.9
@tanstack/start-fn-stubs	npm	= 1.161.9	1.161.13
@tanstack/start-plugin-core	npm	= 1.169.23	1.169.27
@tanstack/start-server-core	npm	= 1.167.33	1.167.37
@tanstack/start-static-server-functions	npm	= 1.166.44	1.166.48
@tanstack/start-storage-context	npm	= 1.166.38	1.166.42
@tanstack/valibot-adapter	npm	= 1.166.12	1.166.16
@tanstack/virtual-file-routes	npm	= 1.161.10	1.161.14
@tanstack/vue-router	npm	= 1.169.5	1.169.9
@tanstack/vue-router-devtools	npm	= 1.166.16	1.166.20
@tanstack/vue-router-ssr-query	npm	= 1.166.15	1.166.19
@tanstack/vue-start	npm	= 1.167.61	1.167.65
@tanstack/vue-start-client	npm	= 1.166.46	1.166.50
@tanstack/vue-start-server	npm	= 1.166.50	1.166.54
@tanstack/zod-adapter	npm	= 1.166.12	1.166.16
@tanstack/arktype-adapter	npm	= 1.166.15	1.166.16
@tanstack/eslint-plugin-router	npm	= 1.161.12	1.161.13
@tanstack/eslint-plugin-start	npm	= 0.0.7	0.0.8
@tanstack/history	npm	= 1.161.12	1.161.13
@tanstack/nitro-v2-vite-plugin	npm	= 1.154.15	1.154.16
@tanstack/react-router	npm	= 1.169.8	1.169.9
@tanstack/react-router-devtools	npm	= 1.166.19	1.166.20
@tanstack/react-router-ssr-query	npm	= 1.166.18	1.166.19
@tanstack/react-start	npm	= 1.167.71	1.167.72
@tanstack/react-start-client	npm	= 1.166.54	1.166.55
@tanstack/react-start-rsc	npm	= 0.0.50	0.0.51
@tanstack/react-start-server	npm	= 1.166.58	1.166.59
@tanstack/router-cli	npm	= 1.166.49	1.166.50
@tanstack/router-core	npm	= 1.169.8	1.169.9
@tanstack/router-devtools	npm	= 1.166.19	1.166.20
@tanstack/router-devtools-core	npm	= 1.167.9	1.167.10
@tanstack/router-generator	npm	= 1.166.48	1.166.49
@tanstack/router-plugin	npm	= 1.167.41	1.167.42
@tanstack/router-ssr-query-core	npm	= 1.168.6	1.168.7
@tanstack/router-utils	npm	= 1.161.14	1.161.15
@tanstack/router-vite-plugin	npm	= 1.166.56	1.166.57
@tanstack/solid-router	npm	= 1.169.8	1.169.9
@tanstack/solid-router-devtools	npm	= 1.166.19	1.166.20
@tanstack/solid-router-ssr-query	npm	= 1.166.18	1.166.19
@tanstack/solid-start	npm	= 1.167.68	1.167.69
@tanstack/solid-start-client	npm	= 1.166.53	1.166.54
@tanstack/solid-start-server	npm	= 1.166.57	1.166.58
@tanstack/start-client-core	npm	= 1.168.8	1.168.9
@tanstack/start-fn-stubs	npm	= 1.161.12	1.161.13
@tanstack/start-plugin-core	npm	= 1.169.26	1.169.27
@tanstack/start-server-core	npm	= 1.167.36	1.167.37
@tanstack/start-static-server-functions	npm	= 1.166.47	1.166.48
@tanstack/start-storage-context	npm	= 1.166.41	1.166.42
@tanstack/valibot-adapter	npm	= 1.166.15	1.166.16
@tanstack/virtual-file-routes	npm	= 1.161.13	1.161.14
@tanstack/vue-router	npm	= 1.169.8	1.169.9
@tanstack/vue-router-devtools	npm	= 1.166.19	1.166.20
@tanstack/vue-router-ssr-query	npm	= 1.166.18	1.166.19
@tanstack/vue-start	npm	= 1.167.64	1.167.65
@tanstack/vue-start-client	npm	= 1.166.49	1.166.50
@tanstack/vue-start-server	npm	= 1.166.53	1.166.54
@tanstack/zod-adapter	npm	= 1.166.15	1.166.16

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis:

In progress

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.