{"id":"CVE-2026-45321","summary":"Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys","details":"On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.","aliases":["GHSA-g7cv-rxg3-hmpx"],"modified":"2026-07-08T08:16:56.087534918Z","published":"2026-05-12T00:12:35.452Z","database_specific":{"cwe_ids":["CWE-506"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45321.json","cna_assigner":"GitHub_M","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"1.161.9"},{"last_affected":"1.161.9"},{"introduced":"1.161.12"},{"last_affected":"1.161.12"},{"introduced":"1.161.9"},{"last_affected":"1.161.9"},{"introduced":"1.161.12"},{"last_affected":"1.161.12"},{"introduced":"1.154.15"},{"last_affected":"1.154.15"},{"introduced":"1.167.68"},{"last_affected":"1.167.68"},{"introduced":"1.167.71"},{"last_affected":"1.167.71"},{"introduced":"1.166.54"},{"last_affected":"1.166.54"},{"introduced":"0.0.47"},{"last_affected":"0.0.47"},{"introduced":"0.0.50"},{"last_affected":"0.0.50"},{"introduced":"1.166.55"},{"last_affected":"1.166.55"},{"introduced":"1.166.58"},{"last_affected":"1.166.58"},{"introduced":"1.161.11"},{"last_affected":"1.161.11"},{"introduced":"1.161.14"},{"last_affected":"1.161.14"},{"introduced":"1.166.53"},{"last_affected":"1.166.53"},{"introduced":"1.166.56"},{"last_affected":"1.166.56"},{"introduced":"1.167.68"},{"last_affected":"1.167.68"},{"introduced":"1.166.53"},{"last_affected":"1.166.53"},{"introduced":"1.166.54"},{"last_affected":"1.166.54"},{"introduced":"1.166.57"},{"last_affected":"1.166.57"},{"introduced":"1.161.9"},{"last_affected":"1.161.9"},{"introduced":"1.161.12"},{"last_affected":"1.161.12"},{"introduced":"1.169.23"},{"last_affected":"1.169.23"},{"introduced":"1.169.26"},{"last_affected":"1.169.26"},{"introduced":"1.161.10"},{"last_affected":"1.161.10"},{"introduced":"1.161.13"},{"last_affected":"1.161.13"},{"introduced":"1.166.53"},{"last_affected":"1.166.53"}]}]},"references":[{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45321"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45321.json"},{"type":"ADVISORY","url":"https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45321"},{"type":"REPORT","url":"https://github.com/TanStack/router/issues/7383"},{"type":"ARTICLE","url":"https://tanstack.com/blog/npm-supply-chain-compromise-postmortem"},{"type":"ARTICLE","url":"https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/neilcochran/squawk","events":[{"introduced":"a60d00be86de161b30f2c5ae2d1cd296ae40f563"},{"last_affected":"ef89c4e2a575eadcc03264344908c08ec7c7c890"}],"database_specific":{"source":"CPE_STRING","extracted_events":[{"introduced":"0.6.2"},{"last_affected":"0.6.2"},{"introduced":"0.5.4"},{"last_affected":"0.5.4"},{"introduced":"0.4.2"},{"last_affected":"0.4.2"},{"introduced":"0.4.5"},{"last_affected":"0.4.5"},{"introduced":"0.6.4"},{"last_affected":"0.6.4"},{"introduced":"0.4.4"},{"last_affected":"0.4.4"},{"introduced":"0.6.3"},{"last_affected":"0.6.3"},{"introduced":"0.5.5"},{"last_affected":"0.5.5"},{"introduced":"0.3.5"},{"last_affected":"0.3.5"},{"introduced":"0.7.3"},{"last_affected":"0.7.3"},{"introduced":"0.8.1"},{"last_affected":"0.8.1"},{"introduced":"0.8.2"},{"last_affected":"0.8.2"},{"introduced":"0.8.4"},{"last_affected":"0.8.4"},{"introduced":"0.4.3"},{"last_affected":"0.4.3"},{"introduced":"0.5.2"},{"last_affected":"0.5.2"},{"introduced":"0.5.3"},{"last_affected":"0.5.3"},{"introduced":"0.8.7"},{"last_affected":"0.8.7"},{"introduced":"0.5.7"},{"last_affected":"0.5.7"},{"introduced":"0.6.7"},{"last_affected":"0.6.7"},{"introduced":"0.4.7"},{"last_affected":"0.4.7"},{"introduced":"0.3.7"},{"last_affected":"0.3.7"},{"introduced":"0.5.9"},{"last_affected":"0.5.9"},{"introduced":"0.3.2"},{"last_affected":"0.3.2"},{"introduced":"0.3.3"},{"last_affected":"0.3.3"},{"introduced":"0.8.5"},{"last_affected":"0.8.5"}],"cpe":["cpe:2.3:a:neilcochran:squawk\\/airports:0.6.2:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/airspace-data:0.5.4:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/airway-data:0.5.4:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/airways:0.4.2:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/airways:0.4.5:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/fix-data:0.6.4:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/flight-math:0.5.4:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/geo:0.4.4:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/geo:0.4.5:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/navaid-data:0.6.4:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/navaids:0.4.2:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/navaids:0.4.5:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/units:0.4.4:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/airports:0.6.3:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/airway-data:0.5.5:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/fixes:0.3.5:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/flight-math:0.5.5:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/flightplan:0.5.5:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/icao-registry:0.5.5:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/procedure-data:0.7.3:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/procedures:0.5.5:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/airspace:0.8.1:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/types:0.8.1:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:wot-api:0.8.1:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/airspace:0.8.2:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/types:0.8.2:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:wot-api:0.8.2:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/airspace:0.8.4:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/airways:0.4.3:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/flightplan:0.5.2:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/icao-registry:0.5.2:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/icao-registry-data:0.8.4:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/navaids:0.4.3:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/procedures:0.5.2:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/types:0.8.4:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/units:0.4.3:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:wot-api:0.8.4:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/airspace-data:0.5.3:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/flightplan:0.5.3:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/icao-registry:0.5.3:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/icao-registry-data:0.8.7:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/procedures:0.5.3:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/airway-data:0.5.7:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/fix-data:0.6.7:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/flight-math:0.5.7:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/geo:0.4.7:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/navaid-data:0.6.7:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/notams:0.3.7:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/weather:0.5.7:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/weather:0.5.9:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/fixes:0.3.2:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/fixes:0.3.3:*:*:*:*:node.js:*:*","cpe:2.3:a:neilcochran:squawk\\/icao-registry-data:0.8.5:*:*:*:*:node.js:*:*"]}},{"type":"GIT","repo":"https://github.com/tanstack/router","events":[{"introduced":"91d10855e8dfe6bd09070eb6c5aa325451548df4"},{"last_affected":"dad0ec8f41fbc11a8c964604cdbbfa51ab1a40ae"}],"database_specific":{"source":["AFFECTED_FIELD","CPE_STRING"],"extracted_events":[{"introduced":"1.166.12"},{"last_affected":"1.166.12"},{"introduced":"1.166.15"},{"last_affected":"1.166.15"},{"introduced":"0.0.4"},{"last_affected":"0.0.4"},{"introduced":"0.0.7"},{"last_affected":"0.0.7"},{"introduced":"1.154.12"},{"last_affected":"1.154.12"},{"introduced":"1.169.5"},{"last_affected":"1.169.5"},{"introduced":"1.169.8"},{"last_affected":"1.169.8"},{"introduced":"1.166.16"},{"last_affected":"1.166.16"},{"introduced":"1.166.19"},{"last_affected":"1.166.19"},{"introduced":"1.167.9"},{"last_affected":"1.167.9"},{"introduced":"1.166.18"},{"last_affected":"1.166.18"},{"introduced":"1.166.51"},{"last_affected":"1.166.51"},{"introduced":"1.166.47"},{"last_affected":"1.166.47"},{"introduced":"1.167.61"},{"last_affected":"1.167.61"},{"introduced":"1.167.64"},{"last_affected":"1.167.64"},{"introduced":"1.166.46"},{"last_affected":"1.166.46"},{"introduced":"1.166.50"},{"last_affected":"1.166.50"},{"introduced":"1.166.49"},{"last_affected":"1.166.49"},{"introduced":"1.166.45"},{"last_affected":"1.166.45"},{"introduced":"1.167.6"},{"last_affected":"1.167.6"},{"introduced":"1.166.48"},{"last_affected":"1.166.48"},{"introduced":"1.166.44"},{"last_affected":"1.166.44"},{"introduced":"1.167.38"},{"last_affected":"1.167.38"},{"introduced":"1.167.41"},{"last_affected":"1.167.41"},{"introduced":"1.168.3"},{"last_affected":"1.168.3"},{"introduced":"1.168.6"},{"last_affected":"1.168.6"},{"introduced":"1.167.65"},{"last_affected":"1.167.65"},{"introduced":"1.168.5"},{"last_affected":"1.168.5"},{"introduced":"1.168.8"},{"last_affected":"1.168.8"},{"introduced":"1.167.33"},{"last_affected":"1.167.33"},{"introduced":"1.167.36"},{"last_affected":"1.167.36"},{"introduced":"1.166.38"},{"last_affected":"1.166.38"},{"introduced":"1.166.41"},{"last_affected":"1.166.41"}],"cpe":["cpe:2.3:a:tanstack:tanstack\\/arktype-adapter:1.166.12:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/valibot-adapter:1.166.12:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/zod-adapter:1.166.12:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/arktype-adapter:1.166.15:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/react-router-ssr-query:1.166.15:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/solid-router-ssr-query:1.166.15:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/valibot-adapter:1.166.15:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/vue-router-ssr-query:1.166.15:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/zod-adapter:1.166.15:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/eslint-plugin-start:0.0.4:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/eslint-plugin-start:0.0.7:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/nitro-v2-vite-plugin:1.154.12:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/react-router:1.169.5:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-core:1.169.5:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/solid-router:1.169.5:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/vue-router:1.169.5:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/react-router:1.169.8:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-core:1.169.8:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/solid-router:1.169.8:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/vue-router:1.169.8:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/react-router-devtools:1.166.16:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-devtools:1.166.16:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/solid-router-devtools:1.166.16:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/vue-router-devtools:1.166.16:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/react-router-devtools:1.166.19:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-devtools:1.166.19:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-devtools-core:1.167.9:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/solid-router-devtools:1.166.19:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/vue-router-devtools:1.166.19:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/react-router-ssr-query:1.166.18:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/solid-router-ssr-query:1.166.18:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/vue-router-ssr-query:1.166.18:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/react-start-client:1.166.51:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/start-static-server-functions:1.166.47:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/vue-start:1.167.61:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/vue-start:1.167.64:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-cli:1.166.46:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/solid-start-client:1.166.50:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/vue-start-client:1.166.46:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/vue-start-server:1.166.50:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-cli:1.166.49:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-generator:1.166.45:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/vue-start-client:1.166.49:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-devtools-core:1.167.6:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-generator:1.166.48:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/start-static-server-functions:1.166.44:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-plugin:1.167.38:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-plugin:1.167.41:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-ssr-query-core:1.168.3:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/router-ssr-query-core:1.168.6:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/solid-start:1.167.65:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/start-client-core:1.168.5:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/start-client-core:1.168.8:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/start-server-core:1.167.33:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/start-server-core:1.167.36:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/start-storage-context:1.166.38:*:*:*:*:node.js:*:*","cpe:2.3:a:tanstack:tanstack\\/start-storage-context:1.166.41:*:*:*:*:node.js:*:*"]}}],"versions":["0.0.4","0.0.7","0.3.2","0.3.3","0.5.3","0.5.7","0.6.2","0.6.3","0.8.1","0.8.2","0.8.4","0.8.5","1.154.12","1.166.12","1.166.15","1.166.16","1.166.18","1.166.19","1.166.38","1.166.41","1.166.46","1.166.48","1.166.49","1.166.51","1.167.33","1.167.36","1.167.38","1.167.41","1.167.6","1.167.65","1.168.3","1.168.5","1.168.6","1.168.8","1.169.5","1.169.8","release-2026-04-30-1752","@tanstack/vue-start@1.167.46","@tanstack/vue-start-server@1.166.41","@tanstack/vue-start-client@1.166.40","@tanstack/vue-router@1.169.0","@tanstack/start-storage-context@1.166.33","@tanstack/start-static-server-functions@1.166.38","@tanstack/start-server-core@1.167.24","@tanstack/start-plugin-core@1.169.8","@tanstack/start-client-core@1.167.22","@tanstack/solid-start@1.167.50","@tanstack/solid-start-server@1.166.45","@tanstack/solid-start-client@1.166.44","@tanstack/solid-router@1.169.0","@tanstack/router-vite-plugin@1.166.45","@tanstack/router-plugin@1.167.30","@tanstack/router-generator@1.166.38","@tanstack/router-core@1.169.0","@tanstack/router-cli@1.166.39","@tanstack/react-start@1.167.53","@tanstack/react-start-server@1.166.46","@tanstack/react-start-rsc@0.0.32","@tanstack/react-start-client@1.166.45","@tanstack/react-router@1.169.0","release-2026-04-29-2019","@tanstack/vue-start@1.167.45","@tanstack/vue-start-server@1.166.40","@tanstack/vue-start-client@1.166.39","@tanstack/vue-router@1.168.22","@tanstack/start-storage-context@1.166.32","@tanstack/start-static-server-functions@1.166.37","@tanstack/start-server-core@1.167.23","@tanstack/start-plugin-core@1.169.7","@tanstack/start-client-core@1.167.21","@tanstack/solid-start@1.167.49","@tanstack/solid-start-server@1.166.44","@tanstack/solid-start-client@1.166.43","@tanstack/solid-router@1.168.26","@tanstack/router-vite-plugin@1.166.44","@tanstack/router-plugin@1.167.29","@tanstack/router-generator@1.166.37","@tanstack/router-core@1.168.18","@tanstack/router-cli@1.166.38","@tanstack/react-start@1.167.52","@tanstack/react-start-server@1.166.45","@tanstack/react-start-rsc@0.0.31","@tanstack/react-start-client@1.166.44","@tanstack/react-router@1.168.26","release-2026-04-29-1601","@tanstack/react-start@1.167.51","@tanstack/react-start-rsc@0.0.30","release-2026-04-27-0758","@tanstack/vue-start@1.167.44","@tanstack/vue-start-server@1.166.39","@tanstack/vue-start-client@1.166.38","@tanstack/vue-router@1.168.21","@tanstack/start-storage-context@1.166.31","@tanstack/start-static-server-functions@1.166.36","@tanstack/start-server-core@1.167.22","@tanstack/start-plugin-core@1.169.6","@tanstack/start-client-core@1.167.20","@tanstack/solid-start@1.167.48","@tanstack/solid-start-server@1.166.43","@tanstack/solid-start-client@1.166.42","@tanstack/solid-router@1.168.25","@tanstack/router-vite-plugin@1.166.43","@tanstack/router-plugin@1.167.28","@tanstack/router-generator@1.166.36","@tanstack/router-core@1.168.17","@tanstack/router-cli@1.166.37","@tanstack/react-start@1.167.50","@tanstack/react-start-server@1.166.44","@tanstack/react-start-rsc@0.0.29","@tanstack/react-start-client@1.166.43","@tanstack/react-router@1.168.25","release-2026-04-26-0258","@tanstack/solid-start@1.167.47","@tanstack/solid-start-server@1.166.42","@tanstack/solid-start-client@1.166.41","@tanstack/solid-router@1.168.24","release-2026-04-26-0214","@tanstack/solid-start@1.167.46","release-2026-04-25-2303","@tanstack/solid-start@1.167.45","@tanstack/solid-start-server@1.166.41","@tanstack/solid-start-client@1.166.40","@tanstack/solid-router@1.168.23","release-2026-04-25-2039","@tanstack/vue-router-ssr-query@1.166.12","@tanstack/solid-router-ssr-query@1.166.12","@tanstack/router-ssr-query-core@1.168.0","@tanstack/react-router-ssr-query@1.166.12","release-2026-04-25-1743","@tanstack/vue-start@1.167.43","@tanstack/start-plugin-core@1.169.5","@tanstack/solid-start@1.167.44","@tanstack/solid-start-server@1.166.40","@tanstack/solid-start-client@1.166.39","@tanstack/solid-router@1.168.22","@tanstack/router-vite-plugin@1.166.42","@tanstack/router-plugin@1.167.27","@tanstack/router-generator@1.166.35","@tanstack/router-cli@1.166.36","@tanstack/react-start@1.167.49","@tanstack/react-start-rsc@0.0.28","release-2026-04-25-0209","@tanstack/vue-start@1.167.42","@tanstack/vue-start-server@1.166.38","@tanstack/vue-start-client@1.166.37","@tanstack/start-static-server-functions@1.166.35","@tanstack/start-server-core@1.167.21","@tanstack/start-plugin-core@1.169.4","@tanstack/start-client-core@1.167.19","@tanstack/solid-start@1.167.43","@tanstack/solid-start-server@1.166.39","@tanstack/solid-start-client@1.166.38","@tanstack/router-vite-plugin@1.166.41","@tanstack/router-plugin@1.167.26","@tanstack/react-start@1.167.48","@tanstack/react-start-server@1.166.43","@tanstack/react-start-rsc@0.0.27","@tanstack/react-start-client@1.166.42","release-2026-04-24-2350","@tanstack/vue-start@1.167.41","@tanstack/start-plugin-core@1.169.3","@tanstack/solid-start@1.167.42","@tanstack/router-vite-plugin@1.166.40","@tanstack/router-plugin@1.167.25","@tanstack/react-start@1.167.47","@tanstack/react-start-rsc@0.0.26","release-2026-04-24-2324","@tanstack/vue-start@1.167.40","@tanstack/vue-start-server@1.166.37","@tanstack/vue-start-client@1.166.36","@tanstack/vue-router@1.168.20","@tanstack/start-storage-context@1.166.30","@tanstack/start-static-server-functions@1.166.34","@tanstack/start-server-core@1.167.20","@tanstack/start-plugin-core@1.169.2","@tanstack/start-client-core@1.167.18","@tanstack/solid-start@1.167.41","@tanstack/solid-start-server@1.166.38","@tanstack/solid-start-client@1.166.37","@tanstack/solid-router@1.168.21","@tanstack/router-vite-plugin@1.166.39","@tanstack/router-plugin@1.167.24","@tanstack/router-generator@1.166.34","@tanstack/router-core@1.168.16","@tanstack/router-cli@1.166.35","@tanstack/react-start@1.167.46","@tanstack/react-start-server@1.166.42","@tanstack/react-start-rsc@0.0.25","@tanstack/react-start-client@1.166.41","@tanstack/react-router@1.168.24","release-2026-04-24-2033","@tanstack/vue-start@1.167.39","@tanstack/start-plugin-core@1.169.1","@tanstack/solid-start@1.167.40","@tanstack/react-start@1.167.45","@tanstack/react-start-rsc@0.0.24","release-2026-04-24-1838","@tanstack/vue-start@1.167.38","@tanstack/start-plugin-core@1.169.0","@tanstack/solid-start@1.167.39","@tanstack/react-start@1.167.44","@tanstack/react-start-rsc@0.0.23","release-2026-04-24-0128","@tanstack/vue-start@1.167.37","@tanstack/start-plugin-core@1.168.0","@tanstack/solid-start@1.167.38","@tanstack/router-vite-plugin@1.166.38","@tanstack/router-utils@1.161.7","@tanstack/router-plugin@1.167.23","@tanstack/router-generator@1.166.33","@tanstack/router-cli@1.166.34","@tanstack/react-start@1.167.43","@tanstack/react-start-rsc@0.0.22","release-2026-04-18-2008","@tanstack/react-start@1.167.42","@tanstack/react-start-server@1.166.41","@tanstack/react-start-rsc@0.0.21","@tanstack/react-start-client@1.166.40","@tanstack/react-router@1.168.23","release-2026-04-16-2154","@tanstack/solid-start@1.167.37","@tanstack/solid-start-server@1.166.37","@tanstack/solid-start-client@1.166.36","@tanstack/solid-router@1.168.20","release-2026-04-15-0231","@tanstack/vue-start@1.167.36","@tanstack/start-plugin-core@1.167.35","@tanstack/solid-start@1.167.36","@tanstack/react-start@1.167.41","@tanstack/react-start-rsc@0.0.20","release-2026-04-15-0022","@tanstack/react-start@1.167.40","@tanstack/react-start-server@1.166.40","@tanstack/react-start-rsc@0.0.19","@tanstack/react-start-client@1.166.39","@tanstack/react-router@1.168.22","release-2026-04-13-2331","@tanstack/vue-start@1.167.35","@tanstack/vue-start-server@1.166.36","@tanstack/vue-start-client@1.166.35","@tanstack/vue-router@1.168.19","@tanstack/start-storage-context@1.166.29","@tanstack/start-static-server-functions@1.166.33","@tanstack/start-server-core@1.167.19","@tanstack/start-plugin-core@1.167.34","@tanstack/start-client-core@1.167.17","@tanstack/solid-start@1.167.35","@tanstack/solid-start-server@1.166.36","@tanstack/solid-start-client@1.166.35","@tanstack/solid-router@1.168.19","@tanstack/router-vite-plugin@1.166.37","@tanstack/router-plugin@1.167.22","@tanstack/router-generator@1.166.32","@tanstack/router-core@1.168.15","@tanstack/router-cli@1.166.33","@tanstack/react-start@1.167.39","@tanstack/react-start-server@1.166.39","@tanstack/react-start-rsc@0.0.18","@tanstack/react-start-client@1.166.38","@tanstack/react-router@1.168.21","release-2026-04-13-2310","@tanstack/react-start@1.167.38","@tanstack/react-start-server@1.166.38","@tanstack/react-start-rsc@0.0.17","@tanstack/react-start-client@1.166.37","@tanstack/react-router@1.168.20","release-2026-04-13-2111","@tanstack/react-start@1.167.37","release-2026-04-13-2041","@tanstack/vue-start@1.167.34","@tanstack/start-plugin-core@1.167.33","@tanstack/solid-start@1.167.34","@tanstack/react-start@1.167.36","@tanstack/react-start-rsc@0.0.16","release-2026-04-13-1923","@tanstack/vue-start@1.167.33","@tanstack/start-plugin-core@1.167.32","@tanstack/solid-start@1.167.33","@tanstack/router-vite-plugin@1.166.36","@tanstack/router-plugin@1.167.21","@tanstack/router-generator@1.166.31","@tanstack/router-cli@1.166.32","@tanstack/react-start@1.167.35","@tanstack/react-start-rsc@0.0.15","release-2026-04-13-0212","@tanstack/vue-start@1.167.32","@tanstack/start-plugin-core@1.167.31","@tanstack/solid-start@1.167.32","@tanstack/router-vite-plugin@1.166.35","@tanstack/router-plugin@1.167.20","@tanstack/react-start@1.167.34","@tanstack/react-start-rsc@0.0.14","release-2026-04-13-0027","@tanstack/vue-start@1.167.31","@tanstack/vue-start-server@1.166.35","@tanstack/vue-start-client@1.166.34","@tanstack/vue-router@1.168.18","@tanstack/start-plugin-core@1.167.30","@tanstack/solid-start@1.167.31","@tanstack/solid-start-server@1.166.35","@tanstack/solid-start-client@1.166.34","@tanstack/solid-router@1.168.18","@tanstack/router-vite-plugin@1.166.34","@tanstack/router-plugin@1.167.19","@tanstack/router-generator@1.166.30","@tanstack/router-cli@1.166.31","@tanstack/react-start@1.167.33","@tanstack/react-start-server@1.166.37","@tanstack/react-start-rsc@0.0.13","@tanstack/react-start-client@1.166.36","@tanstack/react-router@1.168.19","release-2026-04-12-0035","@tanstack/vue-start@1.167.30","@tanstack/start-plugin-core@1.167.29","@tanstack/solid-start@1.167.30","@tanstack/router-vite-plugin@1.166.33","@tanstack/router-plugin@1.167.18","@tanstack/react-start@1.167.32","@tanstack/react-start-rsc@0.0.12","release-2026-04-11-1445","@tanstack/vue-start@1.167.26","@tanstack/start-plugin-core@1.167.25","@tanstack/solid-start@1.167.26","@tanstack/react-start@1.167.28","@tanstack/react-start-rsc@0.0.8","release-2026-04-11-2135","@tanstack/vue-start@1.167.29","@tanstack/vue-start-server@1.166.34","@tanstack/vue-start-client@1.166.33","@tanstack/vue-router@1.168.17","@tanstack/start-storage-context@1.166.28","@tanstack/start-static-server-functions@1.166.32","@tanstack/start-server-core@1.167.18","@tanstack/start-plugin-core@1.167.28","@tanstack/start-client-core@1.167.16","@tanstack/solid-start@1.167.29","@tanstack/solid-start-server@1.166.34","@tanstack/solid-start-client@1.166.33","@tanstack/solid-router@1.168.17","@tanstack/router-vite-plugin@1.166.32","@tanstack/router-plugin@1.167.17","@tanstack/router-generator@1.166.29","@tanstack/router-core@1.168.14","@tanstack/router-cli@1.166.30","@tanstack/react-start@1.167.31","@tanstack/react-start-server@1.166.36","@tanstack/react-start-rsc@0.0.11","@tanstack/react-start-client@1.166.35","@tanstack/react-router@1.168.18","release-2026-04-11-1818","@tanstack/vue-start@1.167.28","@tanstack/vue-start-server@1.166.33","@tanstack/vue-start-client@1.166.32","@tanstack/vue-router@1.168.16","@tanstack/start-storage-context@1.166.27","@tanstack/start-static-server-functions@1.166.31","@tanstack/start-server-core@1.167.17","@tanstack/start-plugin-core@1.167.27","@tanstack/start-client-core@1.167.15","@tanstack/solid-start@1.167.28","@tanstack/solid-start-server@1.166.33","@tanstack/solid-start-client@1.166.32","@tanstack/solid-router@1.168.16","@tanstack/router-vite-plugin@1.166.31","@tanstack/router-plugin@1.167.16","@tanstack/router-generator@1.166.28","@tanstack/router-core@1.168.13","@tanstack/router-cli@1.166.29","@tanstack/react-start@1.167.30","@tanstack/react-start-server@1.166.35","@tanstack/react-start-rsc@0.0.10","@tanstack/react-start-client@1.166.34","@tanstack/react-router@1.168.17","release-2026-04-11-1746","@tanstack/vue-start@1.167.27","@tanstack/vue-start-server@1.166.32","@tanstack/vue-start-client@1.166.31","@tanstack/vue-router@1.168.15","@tanstack/start-storage-context@1.166.26","@tanstack/start-static-server-functions@1.166.30","@tanstack/start-server-core@1.167.16","@tanstack/start-plugin-core@1.167.26","@tanstack/start-client-core@1.167.14","@tanstack/solid-start@1.167.27","@tanstack/solid-start-server@1.166.32","@tanstack/solid-start-client@1.166.31","@tanstack/solid-router@1.168.15","@tanstack/router-vite-plugin@1.166.30","@tanstack/router-plugin@1.167.15","@tanstack/router-generator@1.166.27","@tanstack/router-core@1.168.12","@tanstack/router-cli@1.166.28","@tanstack/react-start@1.167.29","@tanstack/react-start-server@1.166.34","@tanstack/react-start-rsc@0.0.9","@tanstack/react-start-client@1.166.33","@tanstack/react-router@1.168.16","release-2026-04-11-1125","@tanstack/vue-start@1.167.25","@tanstack/vue-start-server@1.166.31","@tanstack/vue-start-client@1.166.30","@tanstack/vue-router@1.168.14","@tanstack/vue-router-devtools@1.166.13","@tanstack/start-storage-context@1.166.25","@tanstack/start-static-server-functions@1.166.29","@tanstack/start-server-core@1.167.15","@tanstack/start-plugin-core@1.167.24","@tanstack/start-client-core@1.167.13","@tanstack/solid-start@1.167.25","@tanstack/solid-start-server@1.166.31","@tanstack/solid-start-client@1.166.30","@tanstack/solid-router@1.168.14","@tanstack/solid-router-devtools@1.166.13","@tanstack/router-vite-plugin@1.166.29","@tanstack/router-plugin@1.167.14","@tanstack/router-generator@1.166.26","@tanstack/router-devtools@1.166.13","@tanstack/router-devtools-core@1.167.3","@tanstack/router-core@1.168.11","@tanstack/router-cli@1.166.27","@tanstack/react-start@1.167.27","@tanstack/react-start-server@1.166.33","@tanstack/react-start-rsc@0.0.7","@tanstack/react-start-client@1.166.32","@tanstack/react-router@1.168.15","@tanstack/react-router-devtools@1.166.13","release-2026-04-11-1045","@tanstack/vue-start@1.167.24","@tanstack/vue-start-server@1.166.30","@tanstack/vue-start-client@1.166.29","@tanstack/vue-router@1.168.13","@tanstack/vue-router-ssr-query@1.166.11","@tanstack/vue-router-devtools@1.166.12","@tanstack/start-storage-context@1.166.24","@tanstack/start-static-server-functions@1.166.28","@tanstack/start-server-core@1.167.14","@tanstack/start-plugin-core@1.167.23","@tanstack/start-client-core@1.167.12","@tanstack/solid-start@1.167.24","@tanstack/solid-start-server@1.166.30","@tanstack/solid-start-client@1.166.29","@tanstack/solid-router@1.168.13","@tanstack/solid-router-ssr-query@1.166.11","@tanstack/solid-router-devtools@1.166.12","@tanstack/router-vite-plugin@1.166.28","@tanstack/router-ssr-query-core@1.167.1","@tanstack/router-plugin@1.167.13","@tanstack/router-generator@1.166.25","@tanstack/router-devtools@1.166.12","@tanstack/router-devtools-core@1.167.2","@tanstack/router-core@1.168.10","@tanstack/router-cli@1.166.26","@tanstack/react-start@1.167.26","@tanstack/react-start-server@1.166.32","@tanstack/react-start-rsc@0.0.6","@tanstack/react-start-client@1.166.31","@tanstack/react-router@1.168.14","@tanstack/react-router-ssr-query@1.166.11","@tanstack/react-router-devtools@1.166.12","release-2026-04-11-0754","@tanstack/vue-start@1.167.23","@tanstack/vue-start-server@1.166.29","@tanstack/vue-start-client@1.166.28","@tanstack/start-static-server-functions@1.166.27","@tanstack/start-server-core@1.167.13","@tanstack/start-plugin-core@1.167.22","@tanstack/start-client-core@1.167.11","@tanstack/solid-start@1.167.23","@tanstack/solid-start-server@1.166.29","@tanstack/solid-start-client@1.166.28","@tanstack/react-start@1.167.25","@tanstack/react-start-server@1.166.31","@tanstack/react-start-rsc@0.0.5","@tanstack/react-start-client@1.166.30","release-2026-04-11-0725","@tanstack/vue-start@1.167.22","@tanstack/vue-start-server@1.166.28","@tanstack/start-server-core@1.167.12","@tanstack/start-plugin-core@1.167.21","@tanstack/solid-start@1.167.22","@tanstack/solid-start-server@1.166.28","@tanstack/react-start@1.167.24","@tanstack/react-start-server@1.166.30","@tanstack/react-start-rsc@0.0.4","release-2026-04-11-0121","release-2026-04-10-2048","@tanstack/vue-start@1.167.19","@tanstack/vue-start-server@1.166.27","@tanstack/vue-start-client@1.166.27","@tanstack/vue-router@1.168.12","@tanstack/solid-start@1.167.19","@tanstack/solid-start-server@1.166.27","@tanstack/solid-start-client@1.166.27","@tanstack/solid-router@1.168.12","@tanstack/react-start@1.167.20","@tanstack/react-start-server@1.166.29","@tanstack/react-start-client@1.166.29","@tanstack/react-router@1.168.13","release-2026-04-10-1933","@tanstack/vue-start@1.167.18","@tanstack/vue-start-server@1.166.26","@tanstack/vue-start-client@1.166.26","@tanstack/vue-router@1.168.11","@tanstack/solid-start@1.167.18","@tanstack/solid-start-server@1.166.26","@tanstack/solid-start-client@1.166.26","@tanstack/solid-router@1.168.11","@tanstack/react-start@1.167.19","@tanstack/react-start-server@1.166.28","@tanstack/react-start-client@1.166.28","@tanstack/react-router@1.168.12","release-2026-04-10-1829","@tanstack/vue-start@1.167.17","@tanstack/vue-start-server@1.166.25","@tanstack/vue-start-client@1.166.25","@tanstack/vue-router@1.168.10","@tanstack/solid-start@1.167.17","@tanstack/solid-start-server@1.166.25","@tanstack/solid-start-client@1.166.25","@tanstack/solid-router@1.168.10","@tanstack/react-start@1.167.18","@tanstack/react-start-server@1.166.27","@tanstack/react-start-client@1.166.27","@tanstack/react-router@1.168.11","release-2026-04-10-1800","@tanstack/vue-start@1.167.16","@tanstack/vue-start-server@1.166.24","@tanstack/vue-start-client@1.166.24","@tanstack/start-static-server-functions@1.166.26","@tanstack/start-server-core@1.167.10","@tanstack/start-plugin-core@1.167.18","@tanstack/start-client-core@1.167.10","@tanstack/solid-start@1.167.16","@tanstack/solid-start-server@1.166.24","@tanstack/solid-start-client@1.166.24","@tanstack/react-start@1.167.17","@tanstack/react-start-server@1.166.26","@tanstack/react-start-client@1.166.26","release-2026-03-15-2315","@tanstack/vue-start@1.166.14","@tanstack/vue-start-server@1.166.11","@tanstack/vue-start-client@1.166.11","@tanstack/vue-router@1.167.3","@tanstack/start-storage-context@1.166.11","@tanstack/start-static-server-functions@1.166.13","@tanstack/start-server-core@1.166.11","@tanstack/start-plugin-core@1.166.14","@tanstack/start-client-core@1.166.11","@tanstack/solid-start@1.166.14","@tanstack/solid-start-server@1.166.11","@tanstack/solid-start-client@1.166.11","@tanstack/solid-router@1.167.3","@tanstack/router-vite-plugin@1.166.12","@tanstack/router-plugin@1.166.12","@tanstack/router-generator@1.166.11","@tanstack/router-core@1.167.3","@tanstack/router-cli@1.166.11","@tanstack/react-start@1.166.14","@tanstack/react-start-server@1.166.12","@tanstack/react-start-client@1.166.12","@tanstack/react-router@1.167.3","release-2026-03-15-2243","@tanstack/zod-adapter@1.166.9","@tanstack/vue-start@1.166.13","@tanstack/vue-start-server@1.166.10","@tanstack/vue-start-client@1.166.10","@tanstack/vue-router@1.167.2","@tanstack/vue-router-ssr-query@1.166.9","@tanstack/vue-router-devtools@1.166.9","@tanstack/virtual-file-routes@1.161.6","@tanstack/valibot-adapter@1.166.9","@tanstack/start-storage-context@1.166.10","@tanstack/start-static-server-functions@1.166.12","@tanstack/start-server-core@1.166.10","@tanstack/start-plugin-core@1.166.13","@tanstack/start-fn-stubs@1.161.6","@tanstack/start-client-core@1.166.10","@tanstack/solid-start@1.166.13","@tanstack/solid-start-server@1.166.10","@tanstack/solid-start-client@1.166.10","@tanstack/solid-router@1.167.2","@tanstack/solid-router-ssr-query@1.166.9","@tanstack/solid-router-devtools@1.166.9","@tanstack/router-vite-plugin@1.166.11","@tanstack/router-utils@1.161.6","@tanstack/router-ssr-query-core@1.166.9","@tanstack/router-plugin@1.166.11","@tanstack/router-generator@1.166.10","@tanstack/router-devtools@1.166.9","@tanstack/router-devtools-core@1.166.9","@tanstack/router-core@1.167.2","@tanstack/router-cli@1.166.10","@tanstack/react-start@1.166.13","@tanstack/react-start-server@1.166.11","@tanstack/react-start-client@1.166.11","@tanstack/react-router@1.167.2","@tanstack/react-router-ssr-query@1.166.9","@tanstack/react-router-devtools@1.166.9","@tanstack/nitro-v2-vite-plugin@1.154.9","@tanstack/history@1.161.6","@tanstack/eslint-plugin-router@1.161.6","@tanstack/arktype-adapter@1.166.9","release-2026-03-15-1530","@tanstack/zod-adapter@1.166.8","@tanstack/vue-start@1.166.12","@tanstack/vue-start-server@1.166.9","@tanstack/vue-start-client@1.166.9","@tanstack/vue-router@1.167.1","@tanstack/vue-router-ssr-query@1.166.8","@tanstack/vue-router-devtools@1.166.8","@tanstack/virtual-file-routes@1.161.5","@tanstack/valibot-adapter@1.166.8","@tanstack/start-storage-context@1.166.9","@tanstack/start-static-server-functions@1.166.11","@tanstack/start-server-core@1.166.9","@tanstack/start-plugin-core@1.166.12","@tanstack/start-fn-stubs@1.161.5","@tanstack/start-client-core@1.166.9","@tanstack/solid-start@1.166.12","@tanstack/solid-start-server@1.166.9","@tanstack/solid-start-client@1.166.9","@tanstack/solid-router@1.167.1","@tanstack/solid-router-ssr-query@1.166.8","@tanstack/solid-router-devtools@1.166.8","@tanstack/router-vite-plugin@1.166.10","@tanstack/router-utils@1.161.5","@tanstack/router-ssr-query-core@1.166.8","@tanstack/router-plugin@1.166.10","@tanstack/router-generator@1.166.9","@tanstack/router-devtools@1.166.8","@tanstack/router-devtools-core@1.166.8","@tanstack/router-core@1.167.1","@tanstack/router-cli@1.166.9","@tanstack/react-start@1.166.12","@tanstack/react-start-server@1.166.10","@tanstack/react-start-client@1.166.10","@tanstack/react-router@1.167.1","@tanstack/react-router-ssr-query@1.166.8","@tanstack/react-router-devtools@1.166.8","@tanstack/nitro-v2-vite-plugin@1.154.8","@tanstack/history@1.161.5","@tanstack/eslint-plugin-router@1.161.5","@tanstack/arktype-adapter@1.166.8"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45321.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}]}