Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 275/275 feeds/APIs · 469/469 docs · 9/9 advisories · checked 17:14 UTC Customize Public modeDiscuss ChangeIntel on Discord

Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

Exact source revision recorded 23 Oct 2026 15:48:27 UTC. It does not establish the source's current position. Latest evidence.

cve-program · CVE-2026-45321

Published

arktype-adapter

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "arktype-adapter",
                    "versions": [
                        {
                            "version": "1.166.12",
                            "status": "affected"
                        },
                        {
                            "version": "1.166.15",
                            "status": "affected"
                        }
                    ]
                }

eslint-plugin-router

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "eslint-plugin-router",
                    "versions": [
                        {
                            "version": "1.161.9",
                            "status": "affected"
                        },
                        {
                            "version": "1.161.12",
                            "status": "affected"
                        }
                    ]
                }

eslint-plugin-start

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "eslint-plugin-start",
                    "versions": [
                        {
                            "version": "0.0.4",
                            "status": "affected"
                        },
                        {
                            "version": "0.0.7",
                            "status": "affected"
                        }
                    ]
                }

history

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "history",
                    "versions": [
                        {
                            "version": "1.161.9",
                            "status": "affected"
                        },
                        {
                            "version": "1.161.12",
                            "status": "affected"
                        }
                    ]
                }

nitro-v2-vite-plugin

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "nitro-v2-vite-plugin",
                    "versions": [
                        {
                            "version": "1.154.12",
                            "status": "affected"
                        },
                        {
                            "version": "1.154.15",
                            "status": "affected"
                        }
                    ]
                }

react-router

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "react-router",
                    "versions": [
                        {
                            "version": "1.169.5",
                            "status": "affected"
                        },
                        {
                            "version": "1.169.8",
                            "status": "affected"
                        }
                    ]
                }

react-router-devtools

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "react-router-devtools",
                    "versions": [
                        {
                            "version": "1.166.16",
                            "status": "affected"
                        },
                        {
                            "version": "1.166.19",
                            "status": "affected"
                        }
                    ]
                }

react-router-ssr-query

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "react-router-ssr-query",
                    "versions": [
                        {
                            "version": "1.166.15",
                            "status": "affected"
                        },
                        {
                            "version": "1.166.18",
                            "status": "affected"
                        }
                    ]
                }

react-start

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "react-start",
                    "versions": [
                        {
                            "version": "1.167.68",
                            "status": "affected"
                        },
                        {
                            "version": "1.167.71",
                            "status": "affected"
                        }
                    ]
                }

react-start-client

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "react-start-client",
                    "versions": [
                        {
                            "version": "1.166.51",
                            "status": "affected"
                        },
                        {
                            "version": "1.166.54",
                            "status": "affected"
                        }
                    ]
                }

react-start-rsc

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "react-start-rsc",
                    "versions": [
                        {
                            "version": "0.0.47",
                            "status": "affected"
                        },
                        {
                            "version": "0.0.50",
                            "status": "affected"
                        }
                    ]
                }

react-start-server

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "react-start-server",
                    "versions": [
                        {
                            "version": "1.166.55",
                            "status": "affected"
                        },
                        {
                            "version": "1.166.58",
                            "status": "affected"
                        }
                    ]
                }

router-cli

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "router-cli",
                    "versions": [
                        {
                            "version": "1.166.46",
                            "status": "affected"
                        },
                        {
                            "version": "1.166.49",
                            "status": "affected"
                        }
                    ]
                }

router-core

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "router-core",
                    "versions": [
                        {
                            "version": "1.169.5",
                            "status": "affected"
                        },
                        {
                            "version": "1.169.8",
                            "status": "affected"
                        }
                    ]
                }

router-devtools

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "router-devtools",
                    "versions": [
                        {
                            "version": "1.166.16",
                            "status": "affected"
                        },
                        {
                            "version": "1.166.19",
                            "status": "affected"
                        }
                    ]
                }

router-devtools-core

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "router-devtools-core",
                    "versions": [
                        {
                            "version": "1.167.6",
                            "status": "affected"
                        },
                        {
                            "version": "1.167.9",
                            "status": "affected"
                        }
                    ]
                }

router-generator

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "router-generator",
                    "versions": [
                        {
                            "version": "1.166.45",
                            "status": "affected"
                        },
                        {
                            "version": "1.166.48",
                            "status": "affected"
                        }
                    ]
                }

router-plugin

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "router-plugin",
                    "versions": [
                        {
                            "version": "1.167.38",
                            "status": "affected"
                        },
                        {
                            "version": "1.167.41",
                            "status": "affected"
                        }
                    ]
                }

router-ssr-query-core

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "router-ssr-query-core",
                    "versions": [
                        {
                            "version": "1.168.3",
                            "status": "affected"
                        },
                        {
                            "version": "1.168.6",
                            "status": "affected"
                        }
                    ]
                }

router-utils

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "router-utils",
                    "versions": [
                        {
                            "version": "1.161.11",
                            "status": "affected"
                        },
                        {
                            "version": "1.161.14",
                            "status": "affected"
                        }
                    ]
                }

outer-vite-plugin

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "outer-vite-plugin",
                    "versions": [
                        {
                            "version": "1.166.53",
                            "status": "affected"
                        },
                        {
                            "version": "1.166.56",
                            "status": "affected"
                        }
                    ]
                }

solid-router

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "solid-router",
                    "versions": [
                        {
                            "version": "1.169.5",
                            "status": "affected"
                        },
                        {
                            "version": "1.169.8",
                            "status": "affected"
                        }
                    ]
                }

solid-router-devtools

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "solid-router-devtools",
                    "versions": [
                        {
                            "version": "1.166.16",
                            "status": "affected"
                        },
                        {
                            "version": "1.166.19",
                            "status": "affected"
                        }
                    ]
                }

solid-router-ssr-query

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "solid-router-ssr-query",
                    "versions": [
                        {
                            "version": "1.166.15",
                            "status": "affected"
                        },
                        {
                            "version": "1.166.18",
                            "status": "affected"
                        }
                    ]
                }

solid-start

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "solid-start",
                    "versions": [
                        {
                            "version": "1.167.65",
                            "status": "affected"
                        },
                        {
                            "version": "1.167.68",
                            "status": "affected"
                        }
                    ]
                }

solid-start-client

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "solid-start-client",
                    "versions": [
                        {
                            "version": "1.166.50",
                            "status": "affected"
                        },
                        {
                            "version": "1.166.53",
                            "status": "affected"
                        }
                    ]
                }

solid-start-server

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "solid-start-server",
                    "versions": [
                        {
                            "version": "1.166.54",
                            "status": "affected"
                        },
                        {
                            "version": "1.166.57",
                            "status": "affected"
                        }
                    ]
                }

start-client-core

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "start-client-core",
                    "versions": [
                        {
                            "version": "1.168.5",
                            "status": "affected"
                        },
                        {
                            "version": "1.168.8",
                            "status": "affected"
                        }
                    ]
                }

start-fn-stubs

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "start-fn-stubs",
                    "versions": [
                        {
                            "version": "1.161.9",
                            "status": "affected"
                        },
                        {
                            "version": "1.161.12",
                            "status": "affected"
                        }
                    ]
                }

start-plugin-core

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "start-plugin-core",
                    "versions": [
                        {
                            "version": "1.169.23",
                            "status": "affected"
                        },
                        {
                            "version": "1.169.26",
                            "status": "affected"
                        }
                    ]
                }

start-server-core

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "start-server-core",
                    "versions": [
                        {
                            "version": "1.167.33",
                            "status": "affected"
                        },
                        {
                            "version": "1.167.36",
                            "status": "affected"
                        }
                    ]
                }

start-static-server-functions

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "start-static-server-functions",
                    "versions": [
                        {
                            "version": "1.166.44",
                            "status": "affected"
                        },
                        {
                            "version": "1.166.47",
                            "status": "affected"
                        }
                    ]
                }

start-storage-context

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "start-storage-context",
                    "versions": [
                        {
                            "version": "1.166.38",
                            "status": "affected"
                        },
                        {
                            "version": "1.166.41",
                            "status": "affected"
                        }
                    ]
                }

valibot-adapter

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "valibot-adapter",
                    "versions": [
                        {
                            "version": "1.166.12",
                            "status": "affected"
                        },
                        {
                            "version": "1.166.15",
                            "status": "affected"
                        }
                    ]
                }

virtual-file-routes

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "virtual-file-routes",
                    "versions": [
                        {
                            "version": "1.161.10",
                            "status": "affected"
                        },
                        {
                            "version": "1.161.13",
                            "status": "affected"
                        }
                    ]
                }

vue-router

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "vue-router",
                    "versions": [
                        {
                            "version": "1.169.5",
                            "status": "affected"
                        },
                        {
                            "version": "1.169.8",
                            "status": "affected"
                        }
                    ]
                }

vue-router-devtools

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "vue-router-devtools",
                    "versions": [
                        {
                            "version": "1.166.16",
                            "status": "affected"
                        },
                        {
                            "version": "1.166.19",
                            "status": "affected"
                        }
                    ]
                }

vue-router-ssr-query

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "vue-router-ssr-query",
                    "versions": [
                        {
                            "version": "1.166.15",
                            "status": "affected"
                        },
                        {
                            "version": "1.166.18",
                            "status": "affected"
                        }
                    ]
                }

vue-start

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "vue-start",
                    "versions": [
                        {
                            "version": "1.167.61",
                            "status": "affected"
                        },
                        {
                            "version": "1.167.64",
                            "status": "affected"
                        }
                    ]
                }

vue-start-client

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "vue-start-client",
                    "versions": [
                        {
                            "version": "1.166.46",
                            "status": "affected"
                        },
                        {
                            "version": "1.166.49",
                            "status": "affected"
                        }
                    ]
                }

vue-start-server

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "vue-start-server",
                    "versions": [
                        {
                            "version": "1.166.50",
                            "status": "affected"
                        },
                        {
                            "version": "1.166.53",
                            "status": "affected"
                        }
                    ]
                }

zod-adapter

Vendor product

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "@tanstack",
                    "product": "zod-adapter",
                    "versions": [
                        {
                            "version": "1.166.12",
                            "status": "affected"
                        },
                        {
                            "version": "1.166.15",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 7 Nov 17:14 UTC · 275 of 275 readable · 274 fully read · documentation 469/469 current