CVE-2026-45321

KEV の『悪用』には未遂(脆弱でない環境やハニーポットでの試行)が含まれ、特定の組織が侵害されたことを意味しない。

KEV の登録内容

vulnerabilityName: TanStack Unspecified Vulnerability
vendorProject: TanStack
product: TanStack
dateAdded: 2026-05-27
shortDescription: TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2026-06-10
knownRansomwareCampaignUse: Known
forensicTriage: No
notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx ; https://nvd.nist.gov/vuln/detail/CVE-2026-45321

初めて観測: 2026-10-02T21:06:48Z / 最後に観測: 2026-10-02T21:06:48Z(last_observed_at。値の変更を最後に確認した時刻)

観測した変更

取り込み開始以降、KEV の値の変更は観測していません。

CVE レコード(CVE Program)

state: PUBLISHED
datePublished: 2026-05-12T00:12:35.452Z
dateUpdated: 2026-08-04T03:56:09.005Z

CNA の affected

@tanstack arktype-adapter (1.166.12; 1.166.15)
@tanstack eslint-plugin-router (1.161.9; 1.161.12)
@tanstack eslint-plugin-start (0.0.4; 0.0.7)
@tanstack history (1.161.9; 1.161.12)
@tanstack nitro-v2-vite-plugin (1.154.12; 1.154.15)
@tanstack react-router (1.169.5; 1.169.8)
@tanstack react-router-devtools (1.166.16; 1.166.19)
@tanstack react-router-ssr-query (1.166.15; 1.166.18)
@tanstack react-start (1.167.68; 1.167.71)
@tanstack react-start-client (1.166.51; 1.166.54)
@tanstack react-start-rsc (0.0.47; 0.0.50)
@tanstack react-start-server (1.166.55; 1.166.58)
@tanstack router-cli (1.166.46; 1.166.49)
@tanstack router-core (1.169.5; 1.169.8)
@tanstack router-devtools (1.166.16; 1.166.19)
@tanstack router-devtools-core (1.167.6; 1.167.9)
@tanstack router-generator (1.166.45; 1.166.48)
@tanstack router-plugin (1.167.38; 1.167.41)
@tanstack router-ssr-query-core (1.168.3; 1.168.6)
@tanstack router-utils (1.161.11; 1.161.14)
@tanstack outer-vite-plugin (1.166.53; 1.166.56)
@tanstack solid-router (1.169.5; 1.169.8)
@tanstack solid-router-devtools (1.166.16; 1.166.19)
@tanstack solid-router-ssr-query (1.166.15; 1.166.18)
@tanstack solid-start (1.167.65; 1.167.68)
@tanstack solid-start-client (1.166.50; 1.166.53)
@tanstack solid-start-server (1.166.54; 1.166.57)
@tanstack start-client-core (1.168.5; 1.168.8)
@tanstack start-fn-stubs (1.161.9; 1.161.12)
@tanstack start-plugin-core (1.169.23; 1.169.26)
@tanstack start-server-core (1.167.33; 1.167.36)
@tanstack start-static-server-functions (1.166.44; 1.166.47)
@tanstack start-storage-context (1.166.38; 1.166.41)
@tanstack valibot-adapter (1.166.12; 1.166.15)
@tanstack virtual-file-routes (1.161.10; 1.161.13)
@tanstack vue-router (1.169.5; 1.169.8)
@tanstack vue-router-devtools (1.166.16; 1.166.19)
@tanstack vue-router-ssr-query (1.166.15; 1.166.18)
@tanstack vue-start (1.167.61; 1.167.64)
@tanstack vue-start-client (1.166.46; 1.166.49)
@tanstack vue-start-server (1.166.50; 1.166.53)
@tanstack zod-adapter (1.166.12; 1.166.15)

KEV と CNA で製品の表記が異なる。KEV の vendorProject・product と CNA の affected が、大文字小文字を無視した包含で一致しなかった(機械的な照合で、どちらが正しいかは判定していない)。

外部のページ

出典: CISA Known Exploited Vulnerabilities Catalog(CISA KEV。CC0 1.0)。詳しくは出典表記とライセンス。

出典: CVE Program(CVE レコード)。詳しくは出典表記とライセンス。

Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

脆弱性の一覧へ