Security Flaw in Node Version Manager Affecting Multiple Versions
CVE-2026-121751

2.1LOW

Key Information:

Vendor

Nvm-sh

Status
Nvm
Vendor
CVE Published:
4 November 2026

What is CVE-2026-121751?

The Node Version Manager (nvm) versions 0.39.6 to 0.40.8 contain a security flaw where the command nvm ls-remote and similar commands do not properly validate the version data from the mirror's index.tab. This oversight allows the execution of shell commands when local commands are used to resolve aliases, posing a risk for users accessing compromised mirrors or networks. Users are advised to upgrade to version 0.41.0 or later, which enforces proper validation and mitigates this risk.

Affected Version(s)

nvm 0.39.6 < 0.41.0

References

https://github.com/nvm-sh/nvm/security/advisories/GHSA-7p...
vendor-advisory
https://github.com/nvm-sh/nvm/commit/aa0572b7c48b2652a9f8...
patch

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Anthropic's OSS Scanner, as vulnerabilities ANT-2026-0GXXE91V and ANT-2026-31ZIEY85
Adel Assakaf (https://github.com/assakafpix)
Jordan Harband (https://github.com/ljharb)
.