CVE-2026-45321: CRITICAL (CVSS 9.6), Actively Exploited (CISA KEV)

CRITICAL (CVSS 9.6), Actively Exploited (CISA KEV), EPSS 2.3%. On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself wa