GHSA-g7cv-rxg3-hmpx
Critical · 9.6CVSS
9.6
EPSS
—
Published
May 12, 2026
CISA due date
—
The record
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @tanstack/arktype-adapter | 1.166.12 | 1.166.16 |
| npm | @tanstack/arktype-adapter | 1.166.15 | 1.166.16 |
| npm | @tanstack/eslint-plugin-router | 1.161.12 | 1.161.13 |
| npm | @tanstack/eslint-plugin-router | 1.161.9 | 1.161.13 |
| npm | @tanstack/eslint-plugin-start | 0.0.4 | 0.0.8 |
| npm | @tanstack/eslint-plugin-start | 0.0.7 | 0.0.8 |
| npm | @tanstack/history | 1.161.12 | 1.161.13 |
| npm | @tanstack/history | 1.161.9 | 1.161.13 |
| npm | @tanstack/nitro-v2-vite-plugin | 1.154.12 | 1.154.16 |
| npm | @tanstack/nitro-v2-vite-plugin | 1.154.15 | 1.154.16 |
| npm | @tanstack/react-router | 1.169.5 | 1.169.9 |
| npm | @tanstack/react-router | 1.169.8 | 1.169.9 |
| npm | @tanstack/react-router-devtools | 1.166.16 | 1.166.20 |
| npm | @tanstack/react-router-devtools | 1.166.19 | 1.166.20 |
| npm | @tanstack/react-router-ssr-query | 1.166.15 | 1.166.19 |
| npm | @tanstack/react-router-ssr-query | 1.166.18 | 1.166.19 |
| npm | @tanstack/react-start | 1.167.68 | 1.167.72 |
| npm | @tanstack/react-start | 1.167.71 | 1.167.72 |
| npm | @tanstack/react-start-client | 1.166.51 | 1.166.55 |
| npm | @tanstack/react-start-client | 1.166.54 | 1.166.55 |
| npm | @tanstack/react-start-rsc | 0.0.47 | 0.0.51 |
| npm | @tanstack/react-start-rsc | 0.0.50 | 0.0.51 |
| npm | @tanstack/react-start-server | 1.166.55 | 1.166.59 |
| npm | @tanstack/react-start-server | 1.166.58 | 1.166.59 |
| npm | @tanstack/router-cli | 1.166.46 | 1.166.50 |
| npm | @tanstack/router-cli | 1.166.49 | 1.166.50 |
| npm | @tanstack/router-core | 1.169.5 | 1.169.9 |
| npm | @tanstack/router-core | 1.169.8 | 1.169.9 |
| npm | @tanstack/router-devtools | 1.166.16 | 1.166.20 |
| npm | @tanstack/router-devtools | 1.166.19 | 1.166.20 |
| npm | @tanstack/router-devtools-core | 1.167.6 | 1.167.10 |
| npm | @tanstack/router-devtools-core | 1.167.9 | 1.167.10 |
| npm | @tanstack/router-generator | 1.166.45 | 1.166.49 |
| npm | @tanstack/router-generator | 1.166.48 | 1.166.49 |
| npm | @tanstack/router-plugin | 1.167.38 | 1.167.42 |
| npm | @tanstack/router-plugin | 1.167.41 | 1.167.42 |
| npm | @tanstack/router-ssr-query-core | 1.168.3 | 1.168.7 |
| npm | @tanstack/router-ssr-query-core | 1.168.6 | 1.168.7 |
| npm | @tanstack/router-utils | 1.161.11 | 1.161.15 |
| npm | @tanstack/router-utils | 1.161.14 | 1.161.15 |
| npm | @tanstack/router-vite-plugin | 1.166.53 | 1.166.57 |
| npm | @tanstack/router-vite-plugin | 1.166.56 | 1.166.57 |
| npm | @tanstack/solid-router | 1.169.5 | 1.169.9 |
| npm | @tanstack/solid-router | 1.169.8 | 1.169.9 |
| npm | @tanstack/solid-router-devtools | 1.166.16 | 1.166.20 |
| npm | @tanstack/solid-router-devtools | 1.166.19 | 1.166.20 |
| npm | @tanstack/solid-router-ssr-query | 1.166.15 | 1.166.19 |
| npm | @tanstack/solid-router-ssr-query | 1.166.18 | 1.166.19 |
| npm | @tanstack/solid-start | 1.167.65 | 1.167.69 |
| npm | @tanstack/solid-start | 1.167.68 | 1.167.69 |
| npm | @tanstack/solid-start-client | 1.166.50 | 1.166.54 |
| npm | @tanstack/solid-start-client | 1.166.53 | 1.166.54 |
| npm | @tanstack/solid-start-server | 1.166.54 | 1.166.58 |
| npm | @tanstack/solid-start-server | 1.166.57 | 1.166.58 |
| npm | @tanstack/start-client-core | 1.168.5 | 1.168.9 |
| npm | @tanstack/start-client-core | 1.168.8 | 1.168.9 |
| npm | @tanstack/start-fn-stubs | 1.161.12 | 1.161.13 |
| npm | @tanstack/start-fn-stubs | 1.161.9 | 1.161.13 |
| npm | @tanstack/start-plugin-core | 1.169.23 | 1.169.27 |
| npm | @tanstack/start-plugin-core | 1.169.26 | 1.169.27 |
| npm | @tanstack/start-server-core | 1.167.33 | 1.167.37 |
| npm | @tanstack/start-server-core | 1.167.36 | 1.167.37 |
| npm | @tanstack/start-static-server-functions | 1.166.44 | 1.166.48 |
| npm | @tanstack/start-static-server-functions | 1.166.47 | 1.166.48 |
| npm | @tanstack/start-storage-context | 1.166.38 | 1.166.42 |
| npm | @tanstack/start-storage-context | 1.166.41 | 1.166.42 |
| npm | @tanstack/valibot-adapter | 1.166.12 | 1.166.16 |
| npm | @tanstack/valibot-adapter | 1.166.15 | 1.166.16 |
| npm | @tanstack/virtual-file-routes | 1.161.10 | 1.161.14 |
| npm | @tanstack/virtual-file-routes | 1.161.13 | 1.161.14 |
| npm | @tanstack/vue-router | 1.169.5 | 1.169.9 |
| npm | @tanstack/vue-router | 1.169.8 | 1.169.9 |
| npm | @tanstack/vue-router-devtools | 1.166.16 | 1.166.20 |
| npm | @tanstack/vue-router-devtools | 1.166.19 | 1.166.20 |
| npm | @tanstack/vue-router-ssr-query | 1.166.15 | 1.166.19 |
| npm | @tanstack/vue-router-ssr-query | 1.166.18 | 1.166.19 |
| npm | @tanstack/vue-start | 1.167.61 | 1.167.65 |
| npm | @tanstack/vue-start | 1.167.64 | 1.167.65 |
| npm | @tanstack/vue-start-client | 1.166.46 | 1.166.50 |
| npm | @tanstack/vue-start-client | 1.166.49 | 1.166.50 |
| npm | @tanstack/vue-start-server | 1.166.50 | 1.166.54 |
| npm | @tanstack/vue-start-server | 1.166.53 | 1.166.54 |
| npm | @tanstack/zod-adapter | 1.166.12 | 1.166.16 |
| npm | @tanstack/zod-adapter | 1.166.15 | 1.166.16 |
Related vulnerabilities
- CVE-2026-45321 On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42… Same vulnerability
- GHSA-9m65-766c-r333 TanStack Start - Server Core: Inbound server-function request deserialization could… Also affects @tanstack/start-server-core
- CVE-2026-73532 Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a… CWE-506
- CVE-2026-73533 Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via… CWE-506
- CVE-2026-48160 react-tracked provides state usage tracking with Proxies. CWE-506
- CVE-2026-48159 use-reducer-async is a React useReducer with async actions. CWE-506
- CVE-2026-48158 use-context-selector is a React useContextSelector hook in userland Between 2026-05-18… CWE-506
- CVE-2026-66747 Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present… CWE-506