GHSA-g7cv-rxg3-hmpx CVE-2026-45321

Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

Critical Known exploited npm

Severity: 9.6 / 10; Critical · CVSS 3.1
Exploit chance (EPSS): 3.28%; Chance of exploitation in the next 30 days. Higher than 88.43% of scored vulnerabilities.
Known exploited: Yes; In CISA's catalog since May 27, 2026
Weakness: CWE-506 Embedded Malicious Code
Fix: Available; 42 packages have a fixed version

Exploited in the wild. TanStack Unspecified Vulnerability (TanStack TanStack). Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due for U.S. federal agencies by Jun 10, 2026. Known to be used in ransomware campaigns.

Description

Summary

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.

Each affected package received exactly two malicious versions, published a few minutes apart.

Impact

A user installing any affected version executes a payload (~2.3 MB obfuscated router_init.js) at install time that:

Harvests credentials from common locations:
- AWS instance metadata (IMDS) and Secrets Manager
- GCP metadata service
- Kubernetes service-account tokens
- HashiCorp Vault tokens
- ~/.npmrc (npm tokens)
- GitHub tokens (env vars, gh CLI config, .git-credentials)
- SSH private keys (~/.ssh/)
Exfiltrates harvested data over the Session/Oxen messenger file-upload network (filev2.getsession.org, seed{1,2,3}.getsession.org). This is end-to-end encrypted with no attacker-controlled C2, so blocking by IP or domain is the only network mitigation.
Enumerates packages that the victim maintains via registry.npmjs.org/-/v1/search?text=maintainer:<user> and republishes them with the same injection, propagating the compromise across npm.

Any developer or CI environment that ran npm install, pnpm install, or yarn install against an affected version on 2026-05-11 should be considered compromised. All credentials accessible to the install process should be rotated immediately. Cloud audit logs should be reviewed for activity originating from the affected hosts during and after the install window.

Detection

Inspect the published manifest of any pinned @tanstack/* version. Malicious manifests contain this exact optionalDependencies entry:

"optionalDependencies": {
  "@tanstack/setup": "github:tanstack/router#79ac49eedf774dd4b0cfa308722bc463cfe5885c"
}

To check a version without running install scripts:

npm pack @tanstack/<name>@<version>   # downloads tarball; does NOT execute lifecycle scripts
tar -xzf *.tgz
grep -A3 optionalDependencies package/package.json
ls -la package/router_init.js   # malicious payload, ~2.3 MB, present at package root

The payload file router_init.js is approximately 2.3 MB of obfuscated JavaScript. It is placed at the tarball root and is intentionally not declared in the package's "files" array, so it does not appear in the package's documented contents.

Mechanism

@tanstack/setup is not a real package on the npm registry. The github:tanstack/router#79ac49ee... specifier resolves to an orphan commit pushed to a fork in the tanstack/router GitHub fork network. GitHub serves commits across the entire fork network for git-URL dependencies, so the attacker did not require write access to TanStack/router itself — only the ability to fork and push to their own fork.

When npm processes the optional dependency, it:

Fetches the orphan commit from the fork network.
Installs the commit's declared dependencies (which include a real bun binary).
Runs the commit's prepare lifecycle script: bun run tanstack_runner.js && exit 1. The trailing exit 1 causes the optional install to fail, after which npm silently discards it — leaving no node_modules trace.
The tanstack_runner.js script in turn executes router_init.js from the host package's tarball.

Patches

Affected versions are being deprecated on npm with a SECURITY: notice. Where npm policy allows (no existing third-party dependents), affected versions are also being unpublished. The npm security team has been engaged to pull tarballs server-side for versions that cannot be unpublished.

Clean follow-up releases are being prepared. Update to the patched version listed in the affected-products table for each package, then reinstall from a clean lockfile.

Workarounds

Until clean follow-up releases are available:

Pin every @tanstack/* dependency to a known-good version published before 2026-05-11 19:00 UTC. The last known-good version for most affected packages was published on 2026-03-15.
Delete node_modules and the lockfile, then reinstall to ensure no transitive dependency resolves to a malicious version.
Configure npm to skip lifecycle scripts on install (npm config set ignore-scripts true) as a temporary defense-in-depth measure.
For CI, audit any pipeline that ran install against @tanstack/* between 19:20 and 19:30 UTC on 2026-05-11. Treat the runner as compromised and rotate any secrets it had access to.

Indicators of compromise

Indicator	Value
Malicious git ref	`github:tanstack/router#79ac49eedf774dd4b0cfa308722bc463cfe5885c`
Fictitious package name	`@tanstack/setup`
Payload filename	`router_init.js` (~2.3 MB, package root, undeclared in `files`)
Helper filename in orphan commit	`tanstack_runner.js`
Exfiltration network	`filev2.getsession.org`, `seed1.getsession.org`, `seed2.getsession.org`, `seed3.getsession.org`
Second-stage payload URLs	`https://litter.catbox.moe/h8nc9u.js`, `https://litter.catbox.moe/7rrc6l.mjs`
Poisoned cache key	`Linux-pnpm-store-6f9233a50def742c09fde54f56553d6b449a535adf87d4083690539f49ae4da11`
Publish window (UTC)	2026-05-11 19:20 — 19:26
Publish mechanism	GitHub Actions OIDC trusted publisher (`oidc:db7d6f54-05d5-412b-8a10-e7a8398b303e`)
Workflow runs	https://github.com/TanStack/router/actions/runs/25613093674 (attempt 4), https://github.com/TanStack/router/actions/runs/25691781302
Attacker GitHub accounts	`zblgg` (id 127806521), `voicproducoes` (id 269549300)
Attacker fork (renamed to evade detection)	https://github.com/zblgg/configuration

Credits

The security researcher who initially disclosed the vulnerability publicly with detailed analysis at https://github.com/TanStack/router/issues/7383

References

Public incident tracking issue: https://github.com/TanStack/router/issues/7383
Related research:
- Adnan Khan, "The Monsters in Your Build Cache: GitHub Actions Cache Poisoning" (May 2024)
- GitHub Security Lab, "Keeping your GitHub Actions and workflows secure: Preventing Pwn Requests"
- StepSecurity, "tj-actions/changed-files action is compromised" (March 2025) — the malicious payload reuses this incident's runner-memory extraction technique verbatim

Affected versions

npm

Package	Vulnerable	Fixed in
@tanstack/arktype-adapter	1 listed versions	No fix yet
@tanstack/arktype-adapter	1 listed versions	No fix yet
@tanstack/arktype-adapter	`>= 1.166.12, < 1.166.16`	`1.166.16`
@tanstack/arktype-adapter	`>= 1.166.15, < 1.166.16`	`1.166.16`
@tanstack/eslint-plugin-router	1 listed versions	No fix yet
@tanstack/eslint-plugin-router	1 listed versions	No fix yet
@tanstack/eslint-plugin-router	`>= 1.161.9, < 1.161.13`	`1.161.13`
@tanstack/eslint-plugin-router	`>= 1.161.12, < 1.161.13`	`1.161.13`
@tanstack/eslint-plugin-start	1 listed versions	No fix yet
@tanstack/eslint-plugin-start	1 listed versions	No fix yet
@tanstack/eslint-plugin-start	`>= 0.0.4, < 0.0.8`	`0.0.8`
@tanstack/eslint-plugin-start	`>= 0.0.7, < 0.0.8`	`0.0.8`
@tanstack/history	1 listed versions	No fix yet
@tanstack/history	1 listed versions	No fix yet
@tanstack/history	`>= 1.161.9, < 1.161.13`	`1.161.13`
@tanstack/history	`>= 1.161.12, < 1.161.13`	`1.161.13`
@tanstack/nitro-v2-vite-plugin	1 listed versions	No fix yet
@tanstack/nitro-v2-vite-plugin	1 listed versions	No fix yet
@tanstack/nitro-v2-vite-plugin	`>= 1.154.12, < 1.154.16`	`1.154.16`
@tanstack/nitro-v2-vite-plugin	`>= 1.154.15, < 1.154.16`	`1.154.16`
@tanstack/react-router	1 listed versions	No fix yet
@tanstack/react-router	1 listed versions	No fix yet
@tanstack/react-router	`>= 1.169.5, < 1.169.9`	`1.169.9`
@tanstack/react-router	`>= 1.169.8, < 1.169.9`	`1.169.9`
@tanstack/react-router-devtools	1 listed versions	No fix yet
@tanstack/react-router-devtools	1 listed versions	No fix yet
@tanstack/react-router-devtools	`>= 1.166.16, < 1.166.20`	`1.166.20`
@tanstack/react-router-devtools	`>= 1.166.19, < 1.166.20`	`1.166.20`
@tanstack/react-router-ssr-query	1 listed versions	No fix yet
@tanstack/react-router-ssr-query	1 listed versions	No fix yet
@tanstack/react-router-ssr-query	`>= 1.166.15, < 1.166.19`	`1.166.19`
@tanstack/react-router-ssr-query	`>= 1.166.18, < 1.166.19`	`1.166.19`
@tanstack/react-start	1 listed versions	No fix yet
@tanstack/react-start	1 listed versions	No fix yet
@tanstack/react-start	`>= 1.167.68, < 1.167.72`	`1.167.72`
@tanstack/react-start	`>= 1.167.71, < 1.167.72`	`1.167.72`
@tanstack/react-start-client	1 listed versions	No fix yet
@tanstack/react-start-client	1 listed versions	No fix yet
@tanstack/react-start-client	`>= 1.166.51, < 1.166.55`	`1.166.55`
@tanstack/react-start-client	`>= 1.166.54, < 1.166.55`	`1.166.55`
@tanstack/react-start-rsc	1 listed versions	No fix yet
@tanstack/react-start-rsc	1 listed versions	No fix yet
@tanstack/react-start-rsc	`>= 0.0.47, < 0.0.51`	`0.0.51`
@tanstack/react-start-rsc	`>= 0.0.50, < 0.0.51`	`0.0.51`
@tanstack/react-start-server	1 listed versions	No fix yet
@tanstack/react-start-server	1 listed versions	No fix yet
@tanstack/react-start-server	`>= 1.166.55, < 1.166.59`	`1.166.59`
@tanstack/react-start-server	`>= 1.166.58, < 1.166.59`	`1.166.59`
@tanstack/router-cli	1 listed versions	No fix yet
@tanstack/router-cli	1 listed versions	No fix yet
@tanstack/router-cli	`>= 1.166.46, < 1.166.50`	`1.166.50`
@tanstack/router-cli	`>= 1.166.49, < 1.166.50`	`1.166.50`
@tanstack/router-core	1 listed versions	No fix yet
@tanstack/router-core	1 listed versions	No fix yet
@tanstack/router-core	`>= 1.169.5, < 1.169.9`	`1.169.9`
@tanstack/router-core	`>= 1.169.8, < 1.169.9`	`1.169.9`
@tanstack/router-devtools	1 listed versions	No fix yet
@tanstack/router-devtools	1 listed versions	No fix yet
@tanstack/router-devtools	`>= 1.166.16, < 1.166.20`	`1.166.20`
@tanstack/router-devtools	`>= 1.166.19, < 1.166.20`	`1.166.20`
@tanstack/router-devtools-core	1 listed versions	No fix yet
@tanstack/router-devtools-core	1 listed versions	No fix yet
@tanstack/router-devtools-core	`>= 1.167.6, < 1.167.10`	`1.167.10`
@tanstack/router-devtools-core	`>= 1.167.9, < 1.167.10`	`1.167.10`
@tanstack/router-generator	1 listed versions	No fix yet
@tanstack/router-generator	1 listed versions	No fix yet
@tanstack/router-generator	`>= 1.166.45, < 1.166.49`	`1.166.49`
@tanstack/router-generator	`>= 1.166.48, < 1.166.49`	`1.166.49`
@tanstack/router-plugin	1 listed versions	No fix yet
@tanstack/router-plugin	1 listed versions	No fix yet
@tanstack/router-plugin	`>= 1.167.38, < 1.167.42`	`1.167.42`
@tanstack/router-plugin	`>= 1.167.41, < 1.167.42`	`1.167.42`
@tanstack/router-ssr-query-core	1 listed versions	No fix yet
@tanstack/router-ssr-query-core	1 listed versions	No fix yet
@tanstack/router-ssr-query-core	`>= 1.168.3, < 1.168.7`	`1.168.7`
@tanstack/router-ssr-query-core	`>= 1.168.6, < 1.168.7`	`1.168.7`
@tanstack/router-utils	1 listed versions	No fix yet
@tanstack/router-utils	1 listed versions	No fix yet
@tanstack/router-utils	`>= 1.161.11, < 1.161.15`	`1.161.15`
@tanstack/router-utils	`>= 1.161.14, < 1.161.15`	`1.161.15`
@tanstack/router-vite-plugin	1 listed versions	No fix yet
@tanstack/router-vite-plugin	1 listed versions	No fix yet
@tanstack/router-vite-plugin	`>= 1.166.53, < 1.166.57`	`1.166.57`
@tanstack/router-vite-plugin	`>= 1.166.56, < 1.166.57`	`1.166.57`
@tanstack/solid-router	1 listed versions	No fix yet
@tanstack/solid-router	1 listed versions	No fix yet
@tanstack/solid-router	`>= 1.169.5, < 1.169.9`	`1.169.9`
@tanstack/solid-router	`>= 1.169.8, < 1.169.9`	`1.169.9`
@tanstack/solid-router-devtools	1 listed versions	No fix yet
@tanstack/solid-router-devtools	1 listed versions	No fix yet
@tanstack/solid-router-devtools	`>= 1.166.16, < 1.166.20`	`1.166.20`
@tanstack/solid-router-devtools	`>= 1.166.19, < 1.166.20`	`1.166.20`
@tanstack/solid-router-ssr-query	1 listed versions	No fix yet
@tanstack/solid-router-ssr-query	1 listed versions	No fix yet
@tanstack/solid-router-ssr-query	`>= 1.166.15, < 1.166.19`	`1.166.19`
@tanstack/solid-router-ssr-query	`>= 1.166.18, < 1.166.19`	`1.166.19`
@tanstack/solid-start	1 listed versions	No fix yet
@tanstack/solid-start	1 listed versions	No fix yet
@tanstack/solid-start	`>= 1.167.65, < 1.167.69`	`1.167.69`
@tanstack/solid-start	`>= 1.167.68, < 1.167.69`	`1.167.69`
@tanstack/solid-start-client	1 listed versions	No fix yet
@tanstack/solid-start-client	1 listed versions	No fix yet
@tanstack/solid-start-client	`>= 1.166.50, < 1.166.54`	`1.166.54`
@tanstack/solid-start-client	`>= 1.166.53, < 1.166.54`	`1.166.54`
@tanstack/solid-start-server	1 listed versions	No fix yet
@tanstack/solid-start-server	1 listed versions	No fix yet
@tanstack/solid-start-server	`>= 1.166.54, < 1.166.58`	`1.166.58`
@tanstack/solid-start-server	`>= 1.166.57, < 1.166.58`	`1.166.58`
@tanstack/start-client-core	1 listed versions	No fix yet
@tanstack/start-client-core	1 listed versions	No fix yet
@tanstack/start-client-core	`>= 1.168.5, < 1.168.9`	`1.168.9`
@tanstack/start-client-core	`>= 1.168.8, < 1.168.9`	`1.168.9`
@tanstack/start-fn-stubs	1 listed versions	No fix yet
@tanstack/start-fn-stubs	1 listed versions	No fix yet
@tanstack/start-fn-stubs	`>= 1.161.9, < 1.161.13`	`1.161.13`
@tanstack/start-fn-stubs	`>= 1.161.12, < 1.161.13`	`1.161.13`
@tanstack/start-plugin-core	1 listed versions	No fix yet
@tanstack/start-plugin-core	1 listed versions	No fix yet
@tanstack/start-plugin-core	`>= 1.169.23, < 1.169.27`	`1.169.27`
@tanstack/start-plugin-core	`>= 1.169.26, < 1.169.27`	`1.169.27`
@tanstack/start-server-core	1 listed versions	No fix yet
@tanstack/start-server-core	1 listed versions	No fix yet
@tanstack/start-server-core	`>= 1.167.33, < 1.167.37`	`1.167.37`
@tanstack/start-server-core	`>= 1.167.36, < 1.167.37`	`1.167.37`
@tanstack/start-static-server-functions	1 listed versions	No fix yet
@tanstack/start-static-server-functions	1 listed versions	No fix yet
@tanstack/start-static-server-functions	`>= 1.166.44, < 1.166.48`	`1.166.48`
@tanstack/start-static-server-functions	`>= 1.166.47, < 1.166.48`	`1.166.48`
@tanstack/start-storage-context	1 listed versions	No fix yet
@tanstack/start-storage-context	1 listed versions	No fix yet
@tanstack/start-storage-context	`>= 1.166.38, < 1.166.42`	`1.166.42`
@tanstack/start-storage-context	`>= 1.166.41, < 1.166.42`	`1.166.42`
@tanstack/valibot-adapter	1 listed versions	No fix yet
@tanstack/valibot-adapter	1 listed versions	No fix yet
@tanstack/valibot-adapter	`>= 1.166.12, < 1.166.16`	`1.166.16`
@tanstack/valibot-adapter	`>= 1.166.15, < 1.166.16`	`1.166.16`
@tanstack/virtual-file-routes	1 listed versions	No fix yet
@tanstack/virtual-file-routes	1 listed versions	No fix yet
@tanstack/virtual-file-routes	`>= 1.161.10, < 1.161.14`	`1.161.14`
@tanstack/virtual-file-routes	`>= 1.161.13, < 1.161.14`	`1.161.14`
@tanstack/vue-router	1 listed versions	No fix yet
@tanstack/vue-router	1 listed versions	No fix yet
@tanstack/vue-router	`>= 1.169.5, < 1.169.9`	`1.169.9`
@tanstack/vue-router	`>= 1.169.8, < 1.169.9`	`1.169.9`
@tanstack/vue-router-devtools	1 listed versions	No fix yet
@tanstack/vue-router-devtools	1 listed versions	No fix yet
@tanstack/vue-router-devtools	`>= 1.166.16, < 1.166.20`	`1.166.20`
@tanstack/vue-router-devtools	`>= 1.166.19, < 1.166.20`	`1.166.20`
@tanstack/vue-router-ssr-query	1 listed versions	No fix yet
@tanstack/vue-router-ssr-query	1 listed versions	No fix yet
@tanstack/vue-router-ssr-query	`>= 1.166.15, < 1.166.19`	`1.166.19`
@tanstack/vue-router-ssr-query	`>= 1.166.18, < 1.166.19`	`1.166.19`
@tanstack/vue-start	1 listed versions	No fix yet
@tanstack/vue-start	1 listed versions	No fix yet
@tanstack/vue-start	`>= 1.167.61, < 1.167.65`	`1.167.65`
@tanstack/vue-start	`>= 1.167.64, < 1.167.65`	`1.167.65`
@tanstack/vue-start-client	1 listed versions	No fix yet
@tanstack/vue-start-client	1 listed versions	No fix yet
@tanstack/vue-start-client	`>= 1.166.46, < 1.166.50`	`1.166.50`
@tanstack/vue-start-client	`>= 1.166.49, < 1.166.50`	`1.166.50`
@tanstack/vue-start-server	1 listed versions	No fix yet
@tanstack/vue-start-server	1 listed versions	No fix yet
@tanstack/vue-start-server	`>= 1.166.50, < 1.166.54`	`1.166.54`
@tanstack/vue-start-server	`>= 1.166.53, < 1.166.54`	`1.166.54`
@tanstack/zod-adapter	1 listed versions	No fix yet
@tanstack/zod-adapter	1 listed versions	No fix yet
@tanstack/zod-adapter	`>= 1.166.12, < 1.166.16`	`1.166.16`
@tanstack/zod-adapter	`>= 1.166.15, < 1.166.16`	`1.166.16`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

@tanstack/arktype-adapter npm → `1.166.16`

npm

npm install @tanstack/arktype-adapter@1.166.16

yarn

yarn add @tanstack/arktype-adapter@1.166.16

pnpm

pnpm add @tanstack/arktype-adapter@1.166.16

@tanstack/eslint-plugin-router npm → `1.161.13`

npm

npm install @tanstack/eslint-plugin-router@1.161.13

yarn

yarn add @tanstack/eslint-plugin-router@1.161.13

pnpm

pnpm add @tanstack/eslint-plugin-router@1.161.13

@tanstack/eslint-plugin-start npm → `0.0.8`

npm

npm install @tanstack/eslint-plugin-start@0.0.8

yarn

yarn add @tanstack/eslint-plugin-start@0.0.8

pnpm

pnpm add @tanstack/eslint-plugin-start@0.0.8

@tanstack/history npm → `1.161.13`

npm

npm install @tanstack/history@1.161.13

yarn

yarn add @tanstack/history@1.161.13

pnpm

pnpm add @tanstack/history@1.161.13

@tanstack/nitro-v2-vite-plugin npm → `1.154.16`

npm

npm install @tanstack/nitro-v2-vite-plugin@1.154.16

yarn

yarn add @tanstack/nitro-v2-vite-plugin@1.154.16

pnpm

pnpm add @tanstack/nitro-v2-vite-plugin@1.154.16

@tanstack/react-router npm → `1.169.9`

npm

npm install @tanstack/react-router@1.169.9

yarn

yarn add @tanstack/react-router@1.169.9

pnpm

pnpm add @tanstack/react-router@1.169.9

@tanstack/react-router-devtools npm → `1.166.20`

npm

npm install @tanstack/react-router-devtools@1.166.20

yarn

yarn add @tanstack/react-router-devtools@1.166.20

pnpm

pnpm add @tanstack/react-router-devtools@1.166.20

@tanstack/react-router-ssr-query npm → `1.166.19`

npm

npm install @tanstack/react-router-ssr-query@1.166.19

yarn

yarn add @tanstack/react-router-ssr-query@1.166.19

pnpm

pnpm add @tanstack/react-router-ssr-query@1.166.19

@tanstack/react-start npm → `1.167.72`

npm

npm install @tanstack/react-start@1.167.72

yarn

yarn add @tanstack/react-start@1.167.72

pnpm

pnpm add @tanstack/react-start@1.167.72

@tanstack/react-start-client npm → `1.166.55`

npm

npm install @tanstack/react-start-client@1.166.55

yarn

yarn add @tanstack/react-start-client@1.166.55

pnpm

pnpm add @tanstack/react-start-client@1.166.55

@tanstack/react-start-rsc npm → `0.0.51`

npm

npm install @tanstack/react-start-rsc@0.0.51

yarn

yarn add @tanstack/react-start-rsc@0.0.51

pnpm

pnpm add @tanstack/react-start-rsc@0.0.51

@tanstack/react-start-server npm → `1.166.59`

npm

npm install @tanstack/react-start-server@1.166.59

yarn

yarn add @tanstack/react-start-server@1.166.59

pnpm

pnpm add @tanstack/react-start-server@1.166.59

@tanstack/router-cli npm → `1.166.50`

npm

npm install @tanstack/router-cli@1.166.50

yarn

yarn add @tanstack/router-cli@1.166.50

pnpm

pnpm add @tanstack/router-cli@1.166.50

@tanstack/router-core npm → `1.169.9`

npm

npm install @tanstack/router-core@1.169.9

yarn

yarn add @tanstack/router-core@1.169.9

pnpm

pnpm add @tanstack/router-core@1.169.9

@tanstack/router-devtools npm → `1.166.20`

npm

npm install @tanstack/router-devtools@1.166.20

yarn

yarn add @tanstack/router-devtools@1.166.20

pnpm

pnpm add @tanstack/router-devtools@1.166.20

@tanstack/router-devtools-core npm → `1.167.10`

npm

npm install @tanstack/router-devtools-core@1.167.10

yarn

yarn add @tanstack/router-devtools-core@1.167.10

pnpm

pnpm add @tanstack/router-devtools-core@1.167.10

@tanstack/router-generator npm → `1.166.49`

npm

npm install @tanstack/router-generator@1.166.49

yarn

yarn add @tanstack/router-generator@1.166.49

pnpm

pnpm add @tanstack/router-generator@1.166.49

@tanstack/router-plugin npm → `1.167.42`

npm

npm install @tanstack/router-plugin@1.167.42

yarn

yarn add @tanstack/router-plugin@1.167.42

pnpm

pnpm add @tanstack/router-plugin@1.167.42

@tanstack/router-ssr-query-core npm → `1.168.7`

npm

npm install @tanstack/router-ssr-query-core@1.168.7

yarn

yarn add @tanstack/router-ssr-query-core@1.168.7

pnpm

pnpm add @tanstack/router-ssr-query-core@1.168.7

@tanstack/router-utils npm → `1.161.15`

npm

npm install @tanstack/router-utils@1.161.15

yarn

yarn add @tanstack/router-utils@1.161.15

pnpm

pnpm add @tanstack/router-utils@1.161.15

@tanstack/router-vite-plugin npm → `1.166.57`

npm

npm install @tanstack/router-vite-plugin@1.166.57

yarn

yarn add @tanstack/router-vite-plugin@1.166.57

pnpm

pnpm add @tanstack/router-vite-plugin@1.166.57

@tanstack/solid-router npm → `1.169.9`

npm

npm install @tanstack/solid-router@1.169.9

yarn

yarn add @tanstack/solid-router@1.169.9

pnpm

pnpm add @tanstack/solid-router@1.169.9

@tanstack/solid-router-devtools npm → `1.166.20`

npm

npm install @tanstack/solid-router-devtools@1.166.20

yarn

yarn add @tanstack/solid-router-devtools@1.166.20

pnpm

pnpm add @tanstack/solid-router-devtools@1.166.20

@tanstack/solid-router-ssr-query npm → `1.166.19`

npm

npm install @tanstack/solid-router-ssr-query@1.166.19

yarn

yarn add @tanstack/solid-router-ssr-query@1.166.19

pnpm

pnpm add @tanstack/solid-router-ssr-query@1.166.19

@tanstack/solid-start npm → `1.167.69`

npm

npm install @tanstack/solid-start@1.167.69

yarn

yarn add @tanstack/solid-start@1.167.69

pnpm

pnpm add @tanstack/solid-start@1.167.69

@tanstack/solid-start-client npm → `1.166.54`

npm

npm install @tanstack/solid-start-client@1.166.54

yarn

yarn add @tanstack/solid-start-client@1.166.54

pnpm

pnpm add @tanstack/solid-start-client@1.166.54

@tanstack/solid-start-server npm → `1.166.58`

npm

npm install @tanstack/solid-start-server@1.166.58

yarn

yarn add @tanstack/solid-start-server@1.166.58

pnpm

pnpm add @tanstack/solid-start-server@1.166.58

@tanstack/start-client-core npm → `1.168.9`

npm

npm install @tanstack/start-client-core@1.168.9

yarn

yarn add @tanstack/start-client-core@1.168.9

pnpm

pnpm add @tanstack/start-client-core@1.168.9

@tanstack/start-fn-stubs npm → `1.161.13`

npm

npm install @tanstack/start-fn-stubs@1.161.13

yarn

yarn add @tanstack/start-fn-stubs@1.161.13

pnpm

pnpm add @tanstack/start-fn-stubs@1.161.13

@tanstack/start-plugin-core npm → `1.169.27`

npm

npm install @tanstack/start-plugin-core@1.169.27

yarn

yarn add @tanstack/start-plugin-core@1.169.27

pnpm

pnpm add @tanstack/start-plugin-core@1.169.27

@tanstack/start-server-core npm → `1.167.37`

npm

npm install @tanstack/start-server-core@1.167.37

yarn

yarn add @tanstack/start-server-core@1.167.37

pnpm

pnpm add @tanstack/start-server-core@1.167.37

@tanstack/start-static-server-functions npm → `1.166.48`

npm

npm install @tanstack/start-static-server-functions@1.166.48

yarn

yarn add @tanstack/start-static-server-functions@1.166.48

pnpm

pnpm add @tanstack/start-static-server-functions@1.166.48

@tanstack/start-storage-context npm → `1.166.42`

npm

npm install @tanstack/start-storage-context@1.166.42

yarn

yarn add @tanstack/start-storage-context@1.166.42

pnpm

pnpm add @tanstack/start-storage-context@1.166.42

@tanstack/valibot-adapter npm → `1.166.16`

npm

npm install @tanstack/valibot-adapter@1.166.16

yarn

yarn add @tanstack/valibot-adapter@1.166.16

pnpm

pnpm add @tanstack/valibot-adapter@1.166.16

@tanstack/virtual-file-routes npm → `1.161.14`

npm

npm install @tanstack/virtual-file-routes@1.161.14

yarn

yarn add @tanstack/virtual-file-routes@1.161.14

pnpm

pnpm add @tanstack/virtual-file-routes@1.161.14

@tanstack/vue-router npm → `1.169.9`

npm

npm install @tanstack/vue-router@1.169.9

yarn

yarn add @tanstack/vue-router@1.169.9

pnpm

pnpm add @tanstack/vue-router@1.169.9

@tanstack/vue-router-devtools npm → `1.166.20`

npm

npm install @tanstack/vue-router-devtools@1.166.20

yarn

yarn add @tanstack/vue-router-devtools@1.166.20

pnpm

pnpm add @tanstack/vue-router-devtools@1.166.20

@tanstack/vue-router-ssr-query npm → `1.166.19`

npm

npm install @tanstack/vue-router-ssr-query@1.166.19

yarn

yarn add @tanstack/vue-router-ssr-query@1.166.19

pnpm

pnpm add @tanstack/vue-router-ssr-query@1.166.19

@tanstack/vue-start npm → `1.167.65`

npm

npm install @tanstack/vue-start@1.167.65

yarn

yarn add @tanstack/vue-start@1.167.65

pnpm

pnpm add @tanstack/vue-start@1.167.65

@tanstack/vue-start-client npm → `1.166.50`

npm

npm install @tanstack/vue-start-client@1.166.50

yarn

yarn add @tanstack/vue-start-client@1.166.50

pnpm

pnpm add @tanstack/vue-start-client@1.166.50

@tanstack/vue-start-server npm → `1.166.54`

npm

npm install @tanstack/vue-start-server@1.166.54

yarn

yarn add @tanstack/vue-start-server@1.166.54

pnpm

pnpm add @tanstack/vue-start-server@1.166.54

@tanstack/zod-adapter npm → `1.166.16`

npm

npm install @tanstack/zod-adapter@1.166.16

yarn

yarn add @tanstack/zod-adapter@1.166.16

pnpm

pnpm add @tanstack/zod-adapter@1.166.16

Severity breakdown

CVSS 3.1 9.6

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

Weakness

CWE-506: Embedded Malicious Code

The product contains code that appears to be malicious in nature.

How to prevent it

Implementation, Operation: Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.

References

Advisories

Packages

github.com/TanStack/router

Timeline

May 12, 2026 Published
May 27, 2026 Added to CISA's Known Exploited Vulnerabilities catalog
Jun 10, 2026 Remediation due for U.S. federal agencies
Oct 26, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
CVE-2026-48027 Compromised Nx Console version 18.95.0	Critical Known exploited	Same weakness, CWE-506
CVE-2026-8398 A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from…	Critical Known exploited	Same weakness, CWE-506
GHSA-5mg7-485q-xm76 Two LiteLLM versions published containing credential harvesting malware	Critical	Same weakness, CWE-506
GHSA-69fq-xp46-6x23 Trivy ecosystem supply chain was briefly compromised	Critical Known exploited	Same weakness, CWE-506
CVE-2025-59374 "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain…	Critical Known exploited	Same weakness, CWE-506
GHSA-pxx3-g568-hxr4 color-convert@3.1.1 contains malware after npm account takeover	High	Same weakness, CWE-506
GHSA-5fvm-p68v-5wmh color-name@2.0.1 contains malware after npm account takeover	High	Same weakness, CWE-506
GHSA-4x49-vf9v-38px debug@4.4.2 contains malware after npm account takeover	High	Same weakness, CWE-506

Credits: ashishkurmi

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor

Description

Summary

Impact

Detection

Mechanism

Patches

Workarounds

Indicators of compromise

Credits

References

Affected versions

npm

How to fix

@tanstack/arktype-adapter npm → 1.166.16

@tanstack/eslint-plugin-router npm → 1.161.13

@tanstack/eslint-plugin-start npm → 0.0.8

@tanstack/history npm → 1.161.13

@tanstack/nitro-v2-vite-plugin npm → 1.154.16

@tanstack/react-router npm → 1.169.9

@tanstack/react-router-devtools npm → 1.166.20

@tanstack/react-router-ssr-query npm → 1.166.19

@tanstack/react-start npm → 1.167.72

@tanstack/react-start-client npm → 1.166.55

@tanstack/react-start-rsc npm → 0.0.51

@tanstack/react-start-server npm → 1.166.59

@tanstack/router-cli npm → 1.166.50

@tanstack/router-core npm → 1.169.9

@tanstack/router-devtools npm → 1.166.20

@tanstack/router-devtools-core npm → 1.167.10

@tanstack/router-generator npm → 1.166.49

@tanstack/router-plugin npm → 1.167.42

@tanstack/router-ssr-query-core npm → 1.168.7

@tanstack/router-utils npm → 1.161.15

@tanstack/router-vite-plugin npm → 1.166.57

@tanstack/solid-router npm → 1.169.9

@tanstack/solid-router-devtools npm → 1.166.20

@tanstack/solid-router-ssr-query npm → 1.166.19

@tanstack/solid-start npm → 1.167.69

@tanstack/solid-start-client npm → 1.166.54

@tanstack/solid-start-server npm → 1.166.58

@tanstack/start-client-core npm → 1.168.9

@tanstack/start-fn-stubs npm → 1.161.13

@tanstack/start-plugin-core npm → 1.169.27

@tanstack/start-server-core npm → 1.167.37

@tanstack/start-static-server-functions npm → 1.166.48

@tanstack/start-storage-context npm → 1.166.42

@tanstack/valibot-adapter npm → 1.166.16

@tanstack/virtual-file-routes npm → 1.161.14

@tanstack/vue-router npm → 1.169.9

@tanstack/vue-router-devtools npm → 1.166.20

@tanstack/vue-router-ssr-query npm → 1.166.19

@tanstack/vue-start npm → 1.167.65

@tanstack/vue-start-client npm → 1.166.50

@tanstack/vue-start-server npm → 1.166.54

@tanstack/zod-adapter npm → 1.166.16

Severity breakdown

CVSS 3.1 9.6

Weakness

CWE-506: Embedded Malicious Code

References

Advisories

Packages

Other links

Timeline

Related advisories

@tanstack/arktype-adapter npm → `1.166.16`

@tanstack/eslint-plugin-router npm → `1.161.13`

@tanstack/eslint-plugin-start npm → `0.0.8`

@tanstack/history npm → `1.161.13`

@tanstack/nitro-v2-vite-plugin npm → `1.154.16`

@tanstack/react-router npm → `1.169.9`

@tanstack/react-router-devtools npm → `1.166.20`

@tanstack/react-router-ssr-query npm → `1.166.19`

@tanstack/react-start npm → `1.167.72`

@tanstack/react-start-client npm → `1.166.55`

@tanstack/react-start-rsc npm → `0.0.51`

@tanstack/react-start-server npm → `1.166.59`

@tanstack/router-cli npm → `1.166.50`

@tanstack/router-core npm → `1.169.9`

@tanstack/router-devtools npm → `1.166.20`

@tanstack/router-devtools-core npm → `1.167.10`

@tanstack/router-generator npm → `1.166.49`

@tanstack/router-plugin npm → `1.167.42`

@tanstack/router-ssr-query-core npm → `1.168.7`

@tanstack/router-utils npm → `1.161.15`

@tanstack/router-vite-plugin npm → `1.166.57`

@tanstack/solid-router npm → `1.169.9`

@tanstack/solid-router-devtools npm → `1.166.20`

@tanstack/solid-router-ssr-query npm → `1.166.19`

@tanstack/solid-start npm → `1.167.69`

@tanstack/solid-start-client npm → `1.166.54`

@tanstack/solid-start-server npm → `1.166.58`

@tanstack/start-client-core npm → `1.168.9`

@tanstack/start-fn-stubs npm → `1.161.13`

@tanstack/start-plugin-core npm → `1.169.27`

@tanstack/start-server-core npm → `1.167.37`

@tanstack/start-static-server-functions npm → `1.166.48`

@tanstack/start-storage-context npm → `1.166.42`

@tanstack/valibot-adapter npm → `1.166.16`

@tanstack/virtual-file-routes npm → `1.161.14`

@tanstack/vue-router npm → `1.169.9`

@tanstack/vue-router-devtools npm → `1.166.20`

@tanstack/vue-router-ssr-query npm → `1.166.19`

@tanstack/vue-start npm → `1.167.65`

@tanstack/vue-start-client npm → `1.166.50`

@tanstack/vue-start-server npm → `1.166.54`

@tanstack/zod-adapter npm → `1.166.16`