How severe is CVE-2026-45321?

CVE-2026-45321 has a CVSS score of 9.6 (Critical). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.

Which packages are affected by CVE-2026-45321?

@tanstack/arktype-adapter (npm) versions = 1.166.12; @tanstack/eslint-plugin-router (npm) versions = 1.161.9; @tanstack/eslint-plugin-start (npm) versions = 0.0.4; @tanstack/history (npm) versions = 1.161.9; @tanstack/nitro-v2-vite-plugin (npm) versions = 1.154.12; @tanstack/react-router (npm) versions = 1.169.5; @tanstack/react-router-devtools (npm) versions = 1.166.16; @tanstack/react-router-ssr-query (npm) versions = 1.166.15; @tanstack/react-start (npm) versions = 1.167.68; @tanstack/react-start-client (npm) versions = 1.166.51; @tanstack/react-start-rsc (npm) versions = 0.0.47; @tanstack/react-start-server (npm) versions = 1.166.55; @tanstack/router-cli (npm) versions = 1.166.46; @tanstack/router-core (npm) versions = 1.169.5; @tanstack/router-devtools (npm) versions = 1.166.16; @tanstack/router-devtools-core (npm) versions = 1.167.6; @tanstack/router-generator (npm) versions = 1.166.45; @tanstack/router-plugin (npm) versions = 1.167.38; @tanstack/router-ssr-query-core (npm) versions = 1.168.3; @tanstack/router-utils (npm) versions = 1.161.11; @tanstack/router-vite-plugin (npm) versions = 1.166.53; @tanstack/solid-router (npm) versions = 1.169.5; @tanstack/solid-router-devtools (npm) versions = 1.166.16; @tanstack/solid-router-ssr-query (npm) versions = 1.166.15; @tanstack/solid-start (npm) versions = 1.167.65; @tanstack/solid-start-client (npm) versions = 1.166.50; @tanstack/solid-start-server (npm) versions = 1.166.54; @tanstack/start-client-core (npm) versions = 1.168.5; @tanstack/start-fn-stubs (npm) versions = 1.161.9; @tanstack/start-plugin-core (npm) versions = 1.169.23; @tanstack/start-server-core (npm) versions = 1.167.33; @tanstack/start-static-server-functions (npm) versions = 1.166.44; @tanstack/start-storage-context (npm) versions = 1.166.38; @tanstack/valibot-adapter (npm) versions = 1.166.12; @tanstack/virtual-file-routes (npm) versions = 1.161.10; @tanstack/vue-router (npm) versions = 1.169.5; @tanstack/vue-router-devtools (npm) versions = 1.166.16; @tanstack/vue-router-ssr-query (npm) versions = 1.166.15; @tanstack/vue-start (npm) versions = 1.167.61; @tanstack/vue-start-client (npm) versions = 1.166.46; @tanstack/vue-start-server (npm) versions = 1.166.50; @tanstack/zod-adapter (npm) versions = 1.166.12.

Is CVE-2026-45321 exploitable, and should I be worried?

Whether CVE-2026-45321 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2026-45321 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

How do I fix CVE-2026-45321?

Upgrade: @tanstack/arktype-adapter to 1.166.16 or later, @tanstack/eslint-plugin-router to 1.161.13 or later, @tanstack/eslint-plugin-start to 0.0.8 or later, @tanstack/history to 1.161.13 or later, @tanstack/nitro-v2-vite-plugin to 1.154.16 or later, @tanstack/react-router to 1.169.9 or later, @tanstack/react-router-devtools to 1.166.20 or later, @tanstack/react-router-ssr-query to 1.166.19 or later, @tanstack/react-start to 1.167.72 or later, @tanstack/react-start-client to 1.166.55 or later, @tanstack/react-start-rsc to 0.0.51 or later, @tanstack/react-start-server to 1.166.59 or later, @tanstack/router-cli to 1.166.50 or later, @tanstack/router-core to 1.169.9 or later, @tanstack/router-devtools to 1.166.20 or later, @tanstack/router-devtools-core to 1.167.10 or later, @tanstack/router-generator to 1.166.49 or later, @tanstack/router-plugin to 1.167.42 or later, @tanstack/router-ssr-query-core to 1.168.7 or later, @tanstack/router-utils to 1.161.15 or later, @tanstack/router-vite-plugin to 1.166.57 or later, @tanstack/solid-router to 1.169.9 or later, @tanstack/solid-router-devtools to 1.166.20 or later, @tanstack/solid-router-ssr-query to 1.166.19 or later, @tanstack/solid-start to 1.167.69 or later, @tanstack/solid-start-client to 1.166.54 or later, @tanstack/solid-start-server to 1.166.58 or later, @tanstack/start-client-core to 1.168.9 or later, @tanstack/start-fn-stubs to 1.161.13 or later, @tanstack/start-plugin-core to 1.169.27 or later, @tanstack/start-server-core to 1.167.37 or later, @tanstack/start-static-server-functions to 1.166.48 or later, @tanstack/start-storage-context to 1.166.42 or later, @tanstack/valibot-adapter to 1.166.16 or later, @tanstack/virtual-file-routes to 1.161.14 or later, @tanstack/vue-router to 1.169.9 or later, @tanstack/vue-router-devtools to 1.166.20 or later, @tanstack/vue-router-ssr-query to 1.166.19 or later, @tanstack/vue-start to 1.167.65 or later, @tanstack/vue-start-client to 1.166.50 or later, @tanstack/vue-start-server to 1.166.54 or later, @tanstack/zod-adapter to 1.166.16 or later, @tanstack/arktype-adapter to 1.166.16 or later, @tanstack/eslint-plugin-router to 1.161.13 or later, @tanstack/eslint-plugin-start to 0.0.8 or later, @tanstack/history to 1.161.13 or later, @tanstack/nitro-v2-vite-plugin to 1.154.16 or later, @tanstack/react-router to 1.169.9 or later, @tanstack/react-router-devtools to 1.166.20 or later, @tanstack/react-router-ssr-query to 1.166.19 or later, @tanstack/react-start to 1.167.72 or later, @tanstack/react-start-client to 1.166.55 or later, @tanstack/react-start-rsc to 0.0.51 or later, @tanstack/react-start-server to 1.166.59 or later, @tanstack/router-cli to 1.166.50 or later, @tanstack/router-core to 1.169.9 or later, @tanstack/router-devtools to 1.166.20 or later, @tanstack/router-devtools-core to 1.167.10 or later, @tanstack/router-generator to 1.166.49 or later, @tanstack/router-plugin to 1.167.42 or later, @tanstack/router-ssr-query-core to 1.168.7 or later, @tanstack/router-utils to 1.161.15 or later, @tanstack/router-vite-plugin to 1.166.57 or later, @tanstack/solid-router to 1.169.9 or later, @tanstack/solid-router-devtools to 1.166.20 or later, @tanstack/solid-router-ssr-query to 1.166.19 or later, @tanstack/solid-start to 1.167.69 or later, @tanstack/solid-start-client to 1.166.54 or later, @tanstack/solid-start-server to 1.166.58 or later, @tanstack/start-client-core to 1.168.9 or later, @tanstack/start-fn-stubs to 1.161.13 or later, @tanstack/start-plugin-core to 1.169.27 or later, @tanstack/start-server-core to 1.167.37 or later, @tanstack/start-static-server-functions to 1.166.48 or later, @tanstack/start-storage-context to 1.166.42 or later, @tanstack/valibot-adapter to 1.166.16 or later, @tanstack/virtual-file-routes to 1.161.14 or later, @tanstack/vue-router to 1.169.9 or later, @tanstack/vue-router-devtools to 1.166.20 or later, @tanstack/vue-router-ssr-query to 1.166.19 or later, @tanstack/vue-start to 1.167.65 or later, @tanstack/vue-start-client to 1.166.50 or later, @tanstack/vue-start-server to 1.166.54 or later, @tanstack/zod-adapter to 1.166.16 or later.

CVE-2026-45321 in @tanstack/arktype-adapter | Intelligent Application Security

Summary

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes, a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process, to publish credential-stealing malware under a trusted identity.

Each affected package received exactly two malicious versions, published a few minutes apart.

Detection

Inspect the published manifest of any pinned @tanstack/* version. Malicious manifests contain this exact optionalDependencies entry:

"optionalDependencies": {
  "@tanstack/setup": "github:tanstack/router#79ac49eedf774dd4b0cfa308722bc463cfe5885c"
}

To check a version without running install scripts:

npm pack @tanstack/<name>@<version>   # downloads tarball; does NOT execute lifecycle scripts
tar -xzf *.tgz
grep -A3 optionalDependencies package/package.json
ls -la package/router_init.js   # malicious payload, ~2.3 MB, present at package root

The payload file router_init.js is approximately 2.3 MB of obfuscated JavaScript. It is placed at the tarball root and is intentionally not declared in the package's "files" array, so it does not appear in the package's documented contents.

Mechanism

@tanstack/setup is not a real package on the npm registry. The github:tanstack/router#79ac49ee... specifier resolves to an orphan commit pushed to a fork in the tanstack/router GitHub fork network. GitHub serves commits across the entire fork network for git-URL dependencies, so the attacker did not require write access to TanStack/router itself, only the ability to fork and push to their own fork.

When npm processes the optional dependency, it:

Fetches the orphan commit from the fork network.
Installs the commit's declared dependencies (which include a real bun binary).
Runs the commit's prepare lifecycle script: bun run tanstack_runner.js && exit 1. The trailing exit 1 causes the optional install to fail, after which npm silently discards it, leaving no node_modules trace.
The tanstack_runner.js script in turn executes router_init.js from the host package's tarball.

Workarounds

Until clean follow-up releases are available:

Pin every @tanstack/* dependency to a known-good version published before 2026-05-11 19:00 UTC. The last known-good version for most affected packages was published on 2026-03-15.
Delete node_modules and the lockfile, then reinstall to ensure no transitive dependency resolves to a malicious version.
Configure npm to skip lifecycle scripts on install (npm config set ignore-scripts true) as a temporary defense-in-depth measure.
For CI, audit any pipeline that ran install against @tanstack/* between 19:20 and 19:30 UTC on 2026-05-11. Treat the runner as compromised and rotate any secrets it had access to.

Indicators of compromise

Indicator	Value
Malicious git ref	`github:tanstack/router#79ac49eedf774dd4b0cfa308722bc463cfe5885c`
Fictitious package name	`@tanstack/setup`
Payload filename	`router_init.js` (~2.3 MB, package root, undeclared in `files`)
Helper filename in orphan commit	`tanstack_runner.js`
Exfiltration network	`filev2.getsession.org`, `seed1.getsession.org`, `seed2.getsession.org`, `seed3.getsession.org`
Second-stage payload URLs	`https://litter.catbox.moe/h8nc9u.js`, `https://litter.catbox.moe/7rrc6l.mjs`
Poisoned cache key	`Linux-pnpm-store-6f9233a50def742c09fde54f56553d6b449a535adf87d4083690539f49ae4da11`
Publish window (UTC)	2026-05-11 19:20, 19:26
Publish mechanism	GitHub Actions OIDC trusted publisher (`oidc:db7d6f54-05d5-412b-8a10-e7a8398b303e`)
Workflow runs	https://github.com/TanStack/router/actions/runs/25613093674 (attempt 4), https://github.com/TanStack/router/actions/runs/25691781302
Attacker GitHub accounts	`zblgg` (id 127806521), `voicproducoes` (id 269549300)
Attacker fork (renamed to evade detection)	https://github.com/zblgg/configuration

Credits

The security researcher who initially disclosed the vulnerability publicly with detailed analysis at https://github.com/TanStack/router/issues/7383

References

Public incident tracking issue: https://github.com/TanStack/router/issues/7383
Related research:
- Adnan Khan, "The Monsters in Your Build Cache: GitHub Actions Cache Poisoning" (May 2024)
- GitHub Security Lab, "Keeping your GitHub Actions and workflows secure: Preventing Pwn Requests"
- StepSecurity, "tj-actions/changed-files action is compromised" (March 2025), the malicious payload reuses this incident's runner-memory extraction technique verbatim

Impact

A user installing any affected version executes a payload (~2.3 MB obfuscated router_init.js) at install time that:

Harvests credentials from common locations:
- AWS instance metadata (IMDS) and Secrets Manager
- GCP metadata service
- Kubernetes service-account tokens
- HashiCorp Vault tokens
- ~/.npmrc (npm tokens)
- GitHub tokens (env vars, gh CLI config, .git-credentials)
- SSH private keys (~/.ssh/)
Exfiltrates harvested data over the Session/Oxen messenger file-upload network (filev2.getsession.org, seed{1,2,3}.getsession.org). This is end-to-end encrypted with no attacker-controlled C2, so blocking by IP or domain is the only network mitigation.
Enumerates packages that the victim maintains via registry.npmjs.org/-/v1/search?text=maintainer:<user> and republishes them with the same injection, propagating the compromise across npm.

Any developer or CI environment that ran npm install, pnpm install, or yarn install against an affected version on 2026-05-11 should be considered compromised. All credentials accessible to the install process should be rotated immediately. Cloud audit logs should be reviewed for activity originating from the affected hosts during and after the install window.

CVE-2026-45321 has a CVSS score of 9.6 (Critical). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.166.16, 1.161.13, 0.0.8, 1.154.16, 1.169.9, 1.166.20, 1.166.19, 1.167.72, 1.166.55, 0.0.51, 1.166.59, 1.166.50, 1.167.10, 1.166.49, 1.167.42, 1.168.7, 1.161.15, 1.166.57, 1.167.69, 1.166.54, 1.166.58, 1.168.9, 1.169.27, 1.167.37, 1.166.48, 1.166.42, 1.161.14, 1.167.65); upgrading removes the vulnerable code path.

Affected versions

@tanstack/arktype-adapter (= 1.166.12) @tanstack/eslint-plugin-router (= 1.161.9) @tanstack/eslint-plugin-start (= 0.0.4) @tanstack/history (= 1.161.9) @tanstack/nitro-v2-vite-plugin (= 1.154.12) @tanstack/react-router (= 1.169.5) @tanstack/react-router-devtools (= 1.166.16) @tanstack/react-router-ssr-query (= 1.166.15) @tanstack/react-start (= 1.167.68) @tanstack/react-start-client (= 1.166.51) @tanstack/react-start-rsc (= 0.0.47) @tanstack/react-start-server (= 1.166.55) @tanstack/router-cli (= 1.166.46) @tanstack/router-core (= 1.169.5) @tanstack/router-devtools (= 1.166.16) @tanstack/router-devtools-core (= 1.167.6) @tanstack/router-generator (= 1.166.45) @tanstack/router-plugin (= 1.167.38) @tanstack/router-ssr-query-core (= 1.168.3) @tanstack/router-utils (= 1.161.11) @tanstack/router-vite-plugin (= 1.166.53) @tanstack/solid-router (= 1.169.5) @tanstack/solid-router-devtools (= 1.166.16) @tanstack/solid-router-ssr-query (= 1.166.15) @tanstack/solid-start (= 1.167.65) @tanstack/solid-start-client (= 1.166.50) @tanstack/solid-start-server (= 1.166.54) @tanstack/start-client-core (= 1.168.5) @tanstack/start-fn-stubs (= 1.161.9) @tanstack/start-plugin-core (= 1.169.23) @tanstack/start-server-core (= 1.167.33) @tanstack/start-static-server-functions (= 1.166.44) @tanstack/start-storage-context (= 1.166.38) @tanstack/valibot-adapter (= 1.166.12) @tanstack/virtual-file-routes (= 1.161.10) @tanstack/vue-router (= 1.169.5) @tanstack/vue-router-devtools (= 1.166.16) @tanstack/vue-router-ssr-query (= 1.166.15) @tanstack/vue-start (= 1.167.61) @tanstack/vue-start-client (= 1.166.46) @tanstack/vue-start-server (= 1.166.50) @tanstack/zod-adapter (= 1.166.12) @tanstack/arktype-adapter (= 1.166.15) @tanstack/eslint-plugin-router (= 1.161.12) @tanstack/eslint-plugin-start (= 0.0.7) @tanstack/history (= 1.161.12) @tanstack/nitro-v2-vite-plugin (= 1.154.15) @tanstack/react-router (= 1.169.8) @tanstack/react-router-devtools (= 1.166.19) @tanstack/react-router-ssr-query (= 1.166.18) @tanstack/react-start (= 1.167.71) @tanstack/react-start-client (= 1.166.54) @tanstack/react-start-rsc (= 0.0.50) @tanstack/react-start-server (= 1.166.58) @tanstack/router-cli (= 1.166.49) @tanstack/router-core (= 1.169.8) @tanstack/router-devtools (= 1.166.19) @tanstack/router-devtools-core (= 1.167.9) @tanstack/router-generator (= 1.166.48) @tanstack/router-plugin (= 1.167.41) @tanstack/router-ssr-query-core (= 1.168.6) @tanstack/router-utils (= 1.161.14) @tanstack/router-vite-plugin (= 1.166.56) @tanstack/solid-router (= 1.169.8) @tanstack/solid-router-devtools (= 1.166.19) @tanstack/solid-router-ssr-query (= 1.166.18) @tanstack/solid-start (= 1.167.68) @tanstack/solid-start-client (= 1.166.53) @tanstack/solid-start-server (= 1.166.57) @tanstack/start-client-core (= 1.168.8) @tanstack/start-fn-stubs (= 1.161.12) @tanstack/start-plugin-core (= 1.169.26) @tanstack/start-server-core (= 1.167.36) @tanstack/start-static-server-functions (= 1.166.47) @tanstack/start-storage-context (= 1.166.41) @tanstack/valibot-adapter (= 1.166.15) @tanstack/virtual-file-routes (= 1.161.13) @tanstack/vue-router (= 1.169.8) @tanstack/vue-router-devtools (= 1.166.19) @tanstack/vue-router-ssr-query (= 1.166.18) @tanstack/vue-start (= 1.167.64) @tanstack/vue-start-client (= 1.166.49) @tanstack/vue-start-server (= 1.166.53) @tanstack/zod-adapter (= 1.166.15)

Security releases

@tanstack/arktype-adapter → 1.166.16 (npm) @tanstack/eslint-plugin-router → 1.161.13 (npm) @tanstack/eslint-plugin-start → 0.0.8 (npm) @tanstack/history → 1.161.13 (npm) @tanstack/nitro-v2-vite-plugin → 1.154.16 (npm) @tanstack/react-router → 1.169.9 (npm) @tanstack/react-router-devtools → 1.166.20 (npm) @tanstack/react-router-ssr-query → 1.166.19 (npm) @tanstack/react-start → 1.167.72 (npm) @tanstack/react-start-client → 1.166.55 (npm) @tanstack/react-start-rsc → 0.0.51 (npm) @tanstack/react-start-server → 1.166.59 (npm) @tanstack/router-cli → 1.166.50 (npm) @tanstack/router-core → 1.169.9 (npm) @tanstack/router-devtools → 1.166.20 (npm) @tanstack/router-devtools-core → 1.167.10 (npm) @tanstack/router-generator → 1.166.49 (npm) @tanstack/router-plugin → 1.167.42 (npm) @tanstack/router-ssr-query-core → 1.168.7 (npm) @tanstack/router-utils → 1.161.15 (npm) @tanstack/router-vite-plugin → 1.166.57 (npm) @tanstack/solid-router → 1.169.9 (npm) @tanstack/solid-router-devtools → 1.166.20 (npm) @tanstack/solid-router-ssr-query → 1.166.19 (npm) @tanstack/solid-start → 1.167.69 (npm) @tanstack/solid-start-client → 1.166.54 (npm) @tanstack/solid-start-server → 1.166.58 (npm) @tanstack/start-client-core → 1.168.9 (npm) @tanstack/start-fn-stubs → 1.161.13 (npm) @tanstack/start-plugin-core → 1.169.27 (npm) @tanstack/start-server-core → 1.167.37 (npm) @tanstack/start-static-server-functions → 1.166.48 (npm) @tanstack/start-storage-context → 1.166.42 (npm) @tanstack/valibot-adapter → 1.166.16 (npm) @tanstack/virtual-file-routes → 1.161.14 (npm) @tanstack/vue-router → 1.169.9 (npm) @tanstack/vue-router-devtools → 1.166.20 (npm) @tanstack/vue-router-ssr-query → 1.166.19 (npm) @tanstack/vue-start → 1.167.65 (npm) @tanstack/vue-start-client → 1.166.50 (npm) @tanstack/vue-start-server → 1.166.54 (npm) @tanstack/zod-adapter → 1.166.16 (npm) @tanstack/arktype-adapter → 1.166.16 (npm) @tanstack/eslint-plugin-router → 1.161.13 (npm) @tanstack/eslint-plugin-start → 0.0.8 (npm) @tanstack/history → 1.161.13 (npm) @tanstack/nitro-v2-vite-plugin → 1.154.16 (npm) @tanstack/react-router → 1.169.9 (npm) @tanstack/react-router-devtools → 1.166.20 (npm) @tanstack/react-router-ssr-query → 1.166.19 (npm) @tanstack/react-start → 1.167.72 (npm) @tanstack/react-start-client → 1.166.55 (npm) @tanstack/react-start-rsc → 0.0.51 (npm) @tanstack/react-start-server → 1.166.59 (npm) @tanstack/router-cli → 1.166.50 (npm) @tanstack/router-core → 1.169.9 (npm) @tanstack/router-devtools → 1.166.20 (npm) @tanstack/router-devtools-core → 1.167.10 (npm) @tanstack/router-generator → 1.166.49 (npm) @tanstack/router-plugin → 1.167.42 (npm) @tanstack/router-ssr-query-core → 1.168.7 (npm) @tanstack/router-utils → 1.161.15 (npm) @tanstack/router-vite-plugin → 1.166.57 (npm) @tanstack/solid-router → 1.169.9 (npm) @tanstack/solid-router-devtools → 1.166.20 (npm) @tanstack/solid-router-ssr-query → 1.166.19 (npm) @tanstack/solid-start → 1.167.69 (npm) @tanstack/solid-start-client → 1.166.54 (npm) @tanstack/solid-start-server → 1.166.58 (npm) @tanstack/start-client-core → 1.168.9 (npm) @tanstack/start-fn-stubs → 1.161.13 (npm) @tanstack/start-plugin-core → 1.169.27 (npm) @tanstack/start-server-core → 1.167.37 (npm) @tanstack/start-static-server-functions → 1.166.48 (npm) @tanstack/start-storage-context → 1.166.42 (npm) @tanstack/valibot-adapter → 1.166.16 (npm) @tanstack/virtual-file-routes → 1.161.14 (npm) @tanstack/vue-router → 1.169.9 (npm) @tanstack/vue-router-devtools → 1.166.20 (npm) @tanstack/vue-router-ssr-query → 1.166.19 (npm) @tanstack/vue-start → 1.167.65 (npm) @tanstack/vue-start-client → 1.166.50 (npm) @tanstack/vue-start-server → 1.166.54 (npm) @tanstack/zod-adapter → 1.166.16 (npm)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

See it in your environment

Remediation advice

Affected versions are being deprecated on npm with a SECURITY: notice. Where npm policy allows (no existing third-party dependents), affected versions are also being unpublished. The npm security team has been engaged to pull tarballs server-side for versions that cannot be unpublished.

Clean follow-up releases are being prepared. Update to the patched version listed in the affected-products table for each package, then reinstall from a clean lockfile.

Frequently Asked Questions

What is CVE-2026-45321? CVE-2026-45321 is a critical-severity security vulnerability in @tanstack/arktype-adapter (npm), affecting versions = 1.166.12. It is fixed in 1.166.16, 1.161.13, 0.0.8, 1.154.16, 1.169.9, 1.166.20, 1.166.19, 1.167.72, 1.166.55, 0.0.51, 1.166.59, 1.166.50, 1.167.10, 1.166.49, 1.167.42, 1.168.7, 1.161.15, 1.166.57, 1.167.69, 1.166.54, 1.166.58, 1.168.9, 1.169.27, 1.167.37, 1.166.48, 1.166.42, 1.161.14, 1.167.65.
How severe is CVE-2026-45321? CVE-2026-45321 has a CVSS score of 9.6 (Critical). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
Which packages are affected by CVE-2026-45321?
- @tanstack/arktype-adapter (npm) (versions = 1.166.12)
- @tanstack/eslint-plugin-router (npm) (versions = 1.161.9)
- @tanstack/eslint-plugin-start (npm) (versions = 0.0.4)
- @tanstack/history (npm) (versions = 1.161.9)
- @tanstack/nitro-v2-vite-plugin (npm) (versions = 1.154.12)
- @tanstack/react-router (npm) (versions = 1.169.5)
- @tanstack/react-router-devtools (npm) (versions = 1.166.16)
- @tanstack/react-router-ssr-query (npm) (versions = 1.166.15)
- @tanstack/react-start (npm) (versions = 1.167.68)
- @tanstack/react-start-client (npm) (versions = 1.166.51)
- @tanstack/react-start-rsc (npm) (versions = 0.0.47)
- @tanstack/react-start-server (npm) (versions = 1.166.55)
- @tanstack/router-cli (npm) (versions = 1.166.46)
- @tanstack/router-core (npm) (versions = 1.169.5)
- @tanstack/router-devtools (npm) (versions = 1.166.16)
- @tanstack/router-devtools-core (npm) (versions = 1.167.6)
- @tanstack/router-generator (npm) (versions = 1.166.45)
- @tanstack/router-plugin (npm) (versions = 1.167.38)
- @tanstack/router-ssr-query-core (npm) (versions = 1.168.3)
- @tanstack/router-utils (npm) (versions = 1.161.11)
- @tanstack/router-vite-plugin (npm) (versions = 1.166.53)
- @tanstack/solid-router (npm) (versions = 1.169.5)
- @tanstack/solid-router-devtools (npm) (versions = 1.166.16)
- @tanstack/solid-router-ssr-query (npm) (versions = 1.166.15)
- @tanstack/solid-start (npm) (versions = 1.167.65)
- @tanstack/solid-start-client (npm) (versions = 1.166.50)
- @tanstack/solid-start-server (npm) (versions = 1.166.54)
- @tanstack/start-client-core (npm) (versions = 1.168.5)
- @tanstack/start-fn-stubs (npm) (versions = 1.161.9)
- @tanstack/start-plugin-core (npm) (versions = 1.169.23)
- @tanstack/start-server-core (npm) (versions = 1.167.33)
- @tanstack/start-static-server-functions (npm) (versions = 1.166.44)
- @tanstack/start-storage-context (npm) (versions = 1.166.38)
- @tanstack/valibot-adapter (npm) (versions = 1.166.12)
- @tanstack/virtual-file-routes (npm) (versions = 1.161.10)
- @tanstack/vue-router (npm) (versions = 1.169.5)
- @tanstack/vue-router-devtools (npm) (versions = 1.166.16)
- @tanstack/vue-router-ssr-query (npm) (versions = 1.166.15)
- @tanstack/vue-start (npm) (versions = 1.167.61)
- @tanstack/vue-start-client (npm) (versions = 1.166.46)
- @tanstack/vue-start-server (npm) (versions = 1.166.50)
- @tanstack/zod-adapter (npm) (versions = 1.166.12)
Is there a fix for CVE-2026-45321? Yes. CVE-2026-45321 is fixed in 1.166.16, 1.161.13, 0.0.8, 1.154.16, 1.169.9, 1.166.20, 1.166.19, 1.167.72, 1.166.55, 0.0.51, 1.166.59, 1.166.50, 1.167.10, 1.166.49, 1.167.42, 1.168.7, 1.161.15, 1.166.57, 1.167.69, 1.166.54, 1.166.58, 1.168.9, 1.169.27, 1.167.37, 1.166.48, 1.166.42, 1.161.14, 1.167.65. Upgrade to this version or later.
Is CVE-2026-45321 exploitable, and should I be worried? Whether CVE-2026-45321 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2026-45321 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2026-45321?
- Upgrade @tanstack/arktype-adapter to 1.166.16 or later
- Upgrade @tanstack/eslint-plugin-router to 1.161.13 or later
- Upgrade @tanstack/eslint-plugin-start to 0.0.8 or later
- Upgrade @tanstack/history to 1.161.13 or later
- Upgrade @tanstack/nitro-v2-vite-plugin to 1.154.16 or later
- Upgrade @tanstack/react-router to 1.169.9 or later
- Upgrade @tanstack/react-router-devtools to 1.166.20 or later
- Upgrade @tanstack/react-router-ssr-query to 1.166.19 or later
- Upgrade @tanstack/react-start to 1.167.72 or later
- Upgrade @tanstack/react-start-client to 1.166.55 or later
- Upgrade @tanstack/react-start-rsc to 0.0.51 or later
- Upgrade @tanstack/react-start-server to 1.166.59 or later
- Upgrade @tanstack/router-cli to 1.166.50 or later
- Upgrade @tanstack/router-core to 1.169.9 or later
- Upgrade @tanstack/router-devtools to 1.166.20 or later
- Upgrade @tanstack/router-devtools-core to 1.167.10 or later
- Upgrade @tanstack/router-generator to 1.166.49 or later
- Upgrade @tanstack/router-plugin to 1.167.42 or later
- Upgrade @tanstack/router-ssr-query-core to 1.168.7 or later
- Upgrade @tanstack/router-utils to 1.161.15 or later
- Upgrade @tanstack/router-vite-plugin to 1.166.57 or later
- Upgrade @tanstack/solid-router to 1.169.9 or later
- Upgrade @tanstack/solid-router-devtools to 1.166.20 or later
- Upgrade @tanstack/solid-router-ssr-query to 1.166.19 or later
- Upgrade @tanstack/solid-start to 1.167.69 or later
- Upgrade @tanstack/solid-start-client to 1.166.54 or later
- Upgrade @tanstack/solid-start-server to 1.166.58 or later
- Upgrade @tanstack/start-client-core to 1.168.9 or later
- Upgrade @tanstack/start-fn-stubs to 1.161.13 or later
- Upgrade @tanstack/start-plugin-core to 1.169.27 or later
- Upgrade @tanstack/start-server-core to 1.167.37 or later
- Upgrade @tanstack/start-static-server-functions to 1.166.48 or later
- Upgrade @tanstack/start-storage-context to 1.166.42 or later
- Upgrade @tanstack/valibot-adapter to 1.166.16 or later
- Upgrade @tanstack/virtual-file-routes to 1.161.14 or later
- Upgrade @tanstack/vue-router to 1.169.9 or later
- Upgrade @tanstack/vue-router-devtools to 1.166.20 or later
- Upgrade @tanstack/vue-router-ssr-query to 1.166.19 or later
- Upgrade @tanstack/vue-start to 1.167.65 or later
- Upgrade @tanstack/vue-start-client to 1.166.50 or later
- Upgrade @tanstack/vue-start-server to 1.166.54 or later
- Upgrade @tanstack/zod-adapter to 1.166.16 or later
- Upgrade @tanstack/arktype-adapter to 1.166.16 or later
- Upgrade @tanstack/eslint-plugin-router to 1.161.13 or later
- Upgrade @tanstack/eslint-plugin-start to 0.0.8 or later
- Upgrade @tanstack/history to 1.161.13 or later
- Upgrade @tanstack/nitro-v2-vite-plugin to 1.154.16 or later
- Upgrade @tanstack/react-router to 1.169.9 or later
- Upgrade @tanstack/react-router-devtools to 1.166.20 or later
- Upgrade @tanstack/react-router-ssr-query to 1.166.19 or later
- Upgrade @tanstack/react-start to 1.167.72 or later
- Upgrade @tanstack/react-start-client to 1.166.55 or later
- Upgrade @tanstack/react-start-rsc to 0.0.51 or later
- Upgrade @tanstack/react-start-server to 1.166.59 or later
- Upgrade @tanstack/router-cli to 1.166.50 or later
- Upgrade @tanstack/router-core to 1.169.9 or later
- Upgrade @tanstack/router-devtools to 1.166.20 or later
- Upgrade @tanstack/router-devtools-core to 1.167.10 or later
- Upgrade @tanstack/router-generator to 1.166.49 or later
- Upgrade @tanstack/router-plugin to 1.167.42 or later
- Upgrade @tanstack/router-ssr-query-core to 1.168.7 or later
- Upgrade @tanstack/router-utils to 1.161.15 or later
- Upgrade @tanstack/router-vite-plugin to 1.166.57 or later
- Upgrade @tanstack/solid-router to 1.169.9 or later
- Upgrade @tanstack/solid-router-devtools to 1.166.20 or later
- Upgrade @tanstack/solid-router-ssr-query to 1.166.19 or later
- Upgrade @tanstack/solid-start to 1.167.69 or later
- Upgrade @tanstack/solid-start-client to 1.166.54 or later
- Upgrade @tanstack/solid-start-server to 1.166.58 or later
- Upgrade @tanstack/start-client-core to 1.168.9 or later
- Upgrade @tanstack/start-fn-stubs to 1.161.13 or later
- Upgrade @tanstack/start-plugin-core to 1.169.27 or later
- Upgrade @tanstack/start-server-core to 1.167.37 or later
- Upgrade @tanstack/start-static-server-functions to 1.166.48 or later
- Upgrade @tanstack/start-storage-context to 1.166.42 or later
- Upgrade @tanstack/valibot-adapter to 1.166.16 or later
- Upgrade @tanstack/virtual-file-routes to 1.161.14 or later
- Upgrade @tanstack/vue-router to 1.169.9 or later
- Upgrade @tanstack/vue-router-devtools to 1.166.20 or later
- Upgrade @tanstack/vue-router-ssr-query to 1.166.19 or later
- Upgrade @tanstack/vue-start to 1.167.65 or later
- Upgrade @tanstack/vue-start-client to 1.166.50 or later
- Upgrade @tanstack/vue-start-server to 1.166.54 or later
- Upgrade @tanstack/zod-adapter to 1.166.16 or later

CVE-2026-45321

Summary

Detection

Mechanism

Workarounds

Indicators of compromise

Credits

References

Impact

Affected versions

Security releases

Kodem intelligence

Remediation advice

Frequently Asked Questions

Other vulnerabilities in @tanstack/arktype-adapter

Stop the waste.
Protect your environment with Kodem.

Summary

Detection

Mechanism

Workarounds

Indicators of compromise

Credits

References

Impact

Affected versions

Security releases

Kodem intelligence

Remediation advice

Frequently Asked Questions

Other vulnerabilities in @tanstack/arktype-adapter

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.