@tanstack vulnerabilities
2 published CVEs name @tanstack among the affected products; CISA lists 1 of them as exploited in the wild.
- Published CVEs
- 2
- Last 12 months
- 2
- Critical
- 2
- Known exploited
- 1
Critical 2High 0Medium 0Low 0Not scored 0
Known exploitedNewest addition to KEV first
- CVE-2026-45321
Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
@tanstack · arktype-adapter
ExploitedCritical9.6
Newest CVEs
- CVE-2026-102989
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
TanStack · router
Critical9.3 - CVE-2026-45321
Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
@tanstack · arktype-adapter
ExploitedCritical9.6