Data Loss Vulnerability in Node Version Manager by nvm
CVE-2026-121746

6.7MEDIUM

Key Information:

Vendor

Nvm-sh

Status
Nvm
Vendor
CVE Published:
4 November 2026

What is CVE-2026-121746?

A data loss vulnerability exists in Node Version Manager (nvm) versions 0.40.0 through 0.40.8, where commands like nvm use --save and nvm install --save may overwrite files due to improper handling of symbolic links. When a repository commits a .nvmrc file as a symbolic link to a location outside itself, the user may unintentionally truncate essential file contents, such as shell startup files or authorized SSH keys. This creates a potential for data loss, even though the underlying file structure remains unchanged. The issue is addressed in version 0.41.0, which includes safeguards against writing through symlinks while issuing a warning.

Affected Version(s)

nvm 0.40.0 < 0.41.0

References

https://github.com/nvm-sh/nvm/security/advisories/GHSA-8q...
vendor-advisory
https://github.com/nvm-sh/nvm/commit/3f8411e58d40b904e4ff...
patch

CVSS V4

Score:
6.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adel Assakaf (https://github.com/assakafpix)
Anthropic's OSS Scanner, as part of vulnerability ANT-2026-G9REVGKT
Jordan Harband (https://github.com/ljharb)
.