CVE-2026-45321
CRITICAL CISA KEV RANSOMWARE
ACT NOW
Priority: 0.31
BB Relevance:
70/100
Published: 2026-05-12
Modified: 2026-10-26
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Auth
Conf. Impact
Integ. Impact
Scope Change
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
Required
S:
Changed
C:
High
I:
High
A:
High
Description
TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity.
CISA Known Exploited Vulnerability
Vendor / Product
TanStack — TanStack
Date Added
2026-05-27
Remediation Due
2026-06-10
Ransomware Use
CONFIRMED
This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx ; https://nvd.nist.gov/vuln/detail/CVE-2026-45321
Weakness Classification (1)
Affected Software (343)
Showing 30 of 343 entries
References & Advisories (5)
US Government Resource
Mitigation
Vendor Advisory
Issue Tracking
Exploit
Vendor Advisory
Exploit
Third Party Advisory