Authorization Header Exposure in Node Version Manager by nvm

CVE-2026-121745

What is CVE-2026-121745?

A security concern exists in Node Version Manager (nvm), where sensitive credentials set in the NVM_AUTH_HEADER can be exposed to local users. This issue arises in versions 0.40.0 to 0.40.8, where the credentials are passed to curl or wget through command-line arguments. Local users can view these process arguments using tools like ps, putting accessed tokens at risk, especially on shared machines. This vulnerability highlights the importance of careful management of sensitive environment variables in a multi-user environment. Version 0.41.0 addresses this issue by redirecting credentials to stdin and securing them in a private temporary config file, although BusyBox wget remains vulnerable when used.

References