CVE-2026-26903-PoC

CVE-2026-26903 PoC Denial-of-service via unbounded recursion in TanStack Query'sreplaceEqualDeep function A single crafted query update with deeply nested objects can freeze the JavaScript thread indefinitely , causing complete application unresponsiveness. No authentication or special permission...

tanscript-exploit-check

Mini Shai-Hulud Supply Chain Attack — IOC Checker curl -fsSL https://raw.githubusercontent.com/nkopylov/tanscript-exploit-check/main/check-tanstack-exploit.sh | bash Or clone and run locally: git clone https://github.com/nkopylov/tanscript-exploit-check.git cd tanscript-exploit-check...

tanstack-compromise-checker

tanstack-compromise-checker ⚠️ Disclaimer: This tool was built for my own use case. All indicators are derived from the following advisory sources: GHSA-g7cv-rxg3-hmpx Snyk: TanStack npm packages compromised StepSecurity: Mini Shai-Hulud deep dive If new IOCs, payload variants, or attacker...

CVE-2026-45321-Tanstack

Simulasi Supply Chain Attack — CVE-2026-45321 TanStack Educational Lab for Understanding npm Supply Chain Attacks, CI/CD Abuse, and Install-Time Code Execution Disclaimer Project ini dibuat hanya untuk: pembelajaran keamanan siber, riset defensive security, simulasi local lab, memahami konsep...

tanstack-shield

🛡️ tanstack-shield One-command supply-chain attack scanner for CVE-2026-45321 / GHSA-g7cv-rxg3-hmpx Detects the "Mini Shai-Hulud" worm that compromised 42 @tanstack/ npm packages 84 malicious versions on May 11, 2026. One line — scan your project curl -fsSL...

CVE-2026-45321-Tanstack

Supply Chain Attack Simulation — CVE-2026-45321 TanStack Educational Lab for Understanding npm Supply Chain Attacks, CI/CD Abuse, and Install-Time Code Execution Disclaimer This project is created only for: cybersecurity learning, defensive security research, local lab simulation, understanding t...

are-you-get-tanstack-attack

TanStack Router CVE Scanner A security scanning tool to detect the TanStack Router CVE | TanStack Router GHSA in your projects. Overview This tool scans your codebase for indicators of the TanStack Router vulnerability CVE-2026-45321 / GHSA-g7cv-rxg3-hmpx, which affects specific versions of...

tanstack-compromise-checker

tanstack-compromise-checker Detect indicators of the TanStack npm supply-chain attack on a developer machine, a repository, or a CI runner. Bash script, Docker image, and GitHub Action — same engine, three entry points. CVE-2026-45321 /GHSA-g7cv-rxg3-hmpx On May 11 2026, attackers published 84...

Node.js Module TanStack Start 1.143.12 < 1.168.56 / 1.168.57 / 1.168.60 / 1.169.39 XSS (CVE-2026-102989)

The versions of the TanStack Start Node.js modules installed on the remote host are 1.143.12 or later, prior to their respective patched versions. They are, therefore, affected by a cross-site scripting vulnerability: - The server-function transport passes request payload fields into internal...

@apimatic/cli (>=2.0.0-beta.1, <=2.0.0-beta.6), @bgub/fig-tanstack-start (>=0.1.0-alpha.1, <=1.0.0) +44 more potentially affected by CVE-2026-102989 via @tanstack/start-server-core (>=1.143.12, <=1.169.38)

@tanstack/start-server-core NPM version =1.143.12, =2.0.0-beta.1, =0.1.0-alpha.1, =1.0.0-rc.11, =2.0.0, =2.0.0, =0.1.1, =1.168.32-depup.0, =0.1.31-depup.0, =1.167.23-depup.0, =0.2.0, =0.1.77, =0.1.50, =0.1.43, =0.1.8, =0.2.0 and more Source cves: CVE-2026-102989 Source advisory: GHSA-QX66-FV34-FJ...

@apimatic/cli (>=2.0.0-beta.1, <=2.0.0-beta.6), @bgub/fig-tanstack-start (>=0.1.0-alpha.1, <=1.0.0) +44 more potentially affected by CVE-2026-102989 via @tanstack/start-server-core (>=1.143.12, <=1.169.38)

@tanstack/start-server-core NPM version =1.143.12, =2.0.0-beta.1, =0.1.0-alpha.1, =1.0.0-rc.11, =2.0.0, =2.0.0, =0.1.1, =1.168.32-depup.0, =0.1.31-depup.0, =1.167.23-depup.0, =0.2.0, =0.1.77, =0.1.50, =0.1.43, =0.1.8, =0.2.0 and more Source cves: CVE-2026-102989 Source advisory:...

@apimatic/cli (>=2.0.0-beta.1, <=2.0.0-beta.6), @cangjielang/aceharness (>=1.0.0-rc.11, <=1.0.0-rc.13-test.0) +27 more potentially affected by CVE-2026-102989 via @tanstack/react-start (>=1.166.18, <=1.168.50)

@tanstack/react-start NPM version =1.166.18, =2.0.0-beta.1, =1.0.0-rc.11, =2.0.0, =2.0.0, =0.1.1, =0.2.0, =0.1.77, =0.1.50, =0.1.43, =0.1.8, =0.5.0, =0.0.0, =0.0.2 - @kstackz/auth-toolkit 0.0.0 and more Source cves: CVE-2026-102989 Source advisory: OSV:GHSA-QX66-FV34-FJM8...

EUVD-2026-98849

TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses...

@apimatic/cli (>=2.0.0-beta.1, <=2.0.0-beta.6), @cangjielang/aceharness (>=1.0.0-rc.11, <=1.0.0-rc.13-test.0) +27 more potentially affected by CVE-2026-102989 via @tanstack/react-start (>=1.166.18, <=1.168.50)

@tanstack/react-start NPM version =1.166.18, =2.0.0-beta.1, =1.0.0-rc.11, =2.0.0, =2.0.0, =0.1.1, =0.2.0, =0.1.77, =0.1.50, =0.1.43, =0.1.8, =0.5.0, =0.0.0, =0.0.2 - @kstackz/auth-toolkit 0.0.0 and more Source cves: CVE-2026-102989 Source advisory: GHSA-QX66-FV34-FJM8...

@apimatic/cli (>=2.0.0-beta.1, <=2.0.0-beta.6), @bgub/fig-tanstack-start (>=0.1.0-alpha.1, <=1.0.0) +44 more potentially affected by CVE-2026-102989 via @tanstack/start-server-core (>=1.143.12, <=1.169.38)

@tanstack/start-server-core NPM version =1.143.12, =2.0.0-beta.1, =0.1.0-alpha.1, =1.0.0-rc.11, =2.0.0, =2.0.0, =0.1.1, =1.168.32-depup.0, =0.1.31-depup.0, =1.167.23-depup.0, =0.2.0, =0.1.77, =0.1.50, =0.1.43, =0.1.8, =0.2.0 and more Source cves: CVE-2026-102989 Source advisory:...

GHSA-QX66-FV34-FJM8 TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

Impact An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that...

@apimatic/cli (>=2.0.0-beta.1, <=2.0.0-beta.6), @cangjielang/aceharness (>=1.0.0-rc.11, <=1.0.0-rc.13-test.0) +27 more potentially affected by CVE-2026-102989 via @tanstack/react-start (>=1.166.18, <=1.168.50)

@tanstack/react-start NPM version =1.166.18, =2.0.0-beta.1, =1.0.0-rc.11, =2.0.0, =2.0.0, =0.1.1, =0.2.0, =0.1.77, =0.1.50, =0.1.43, =0.1.8, =0.5.0, =0.0.0, =0.0.2 - @kstackz/auth-toolkit 0.0.0 and more Source cves: CVE-2026-102989 Source advisory: SNYK:JS-TANSTACKREACTSTART-21201266...

TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

Impact An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that...

CVE-2026-102989

TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an...

CVE-2026-102989

TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an...