PatchSiren cyber security CVE debrief
CVE-2026-45321 @tanstack CVE debrief
A critical-severity vulnerability in TanStack has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog with confirmed known ransomware campaign use. The vulnerability is currently unspecified in publicly available details. CISA has established a remediation due date of June 10, 2026. Organizations should prioritize mitigation efforts in accordance with vendor guidance and applicable Binding Operational Directive 22-01 requirements for cloud services.
- Vendor
- @tanstack
- Product
- arktype-adapter
- CVSS
- CRITICAL 9.6
- CISA KEV
- Listed
- Original CVE published
- 2026-05-27
- Original CVE updated
- 2026-05-27
- Advisory published
- 2026-05-27
- Advisory updated
- 2026-05-27
Who should care
Organizations using TanStack libraries or frameworks in production environments, particularly those subject to CISA BOD 22-01 compliance requirements or operating in sectors targeted by ransomware campaigns.
Technical summary
CVE-2026-45321 represents an unspecified critical vulnerability in TanStack products. CISA has confirmed known ransomware campaign use and assigned a remediation due date of June 10, 2026. The vulnerability carries a CVSS score of 9.6. Specific technical details regarding the vulnerability class, affected versions, and attack vectors are not available in the disclosed sources. Organizations using TanStack components should consult vendor security advisories for definitive patching guidance.
Defensive priority
CRITICAL
Recommended defensive actions
- Apply vendor-provided mitigations as soon as possible, per CISA KEV required action guidance
- Follow applicable Binding Operational Directive 22-01 guidance for cloud services where TanStack components are deployed
- Discontinue use of affected TanStack products if vendor mitigations are unavailable
- Monitor TanStack security advisories for specific patch availability and version guidance
- Review environments for TanStack component usage to determine exposure scope
Evidence notes
CISA KEV entry confirms active exploitation with known ransomware campaign use. CVSS 9.6 CRITICAL severity. Specific vulnerability type and affected component versions are not detailed in available sources.
Official resources
-
CVE-2026-45321 CVE record
CVE.org
-
CVE-2026-45321 NVD detail
NVD
-
CISA Known Exploited Vulnerabilities catalog
CISA - Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
-
Source item URL
cisa_kev
CISA KEV disclosure with known ransomware campaign use