Skip to content
OpenAdvisories

Vendor

TanStack

5 known vulnerabilities.

Products

react-start 2 solid-start 2 start-server-core 2 vue-start 2 query 1 arktype-adapter 1 eslint-plugin-router 1 eslint-plugin-start 1 history 1 nitro-v2-vite-plugin 1 react-router 1 react-router-devtools 1 react-router-ssr-query 1 react-start-client 1 react-start-rsc 1 react-start-server 1 router-cli 1 router-core 1 router 1 router-devtools 1 router-devtools-core 1 router-generator 1 router-plugin 1 router-ssr-query-core 1 router-utils 1 outer-vite-plugin 1 solid-router 1 solid-router-devtools 1 solid-router-ssr-query 1 solid-start-client 1 solid-start-server 1 start-client-core 1 start-fn-stubs 1 start-plugin-core 1 start-static-server-functions 1 start-storage-context 1 valibot-adapter 1 db 1 virtual-file-routes 1 vue-router 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.6
    CVE-2026-45321 Exploited · Ransomware Public exploit

    Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

    On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/r…

    TanStack solid-start vue-start react-start npm
    KEV May 27, 2026