npm/@nx/azure-cache CVE-2025-36852: critical 9.4, EPSS 0.26%
@nx/azure-cache Vulnerable to Build Cache Poisoning via Untrusted Pull Requests
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 4.0.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-rrr2-jcr8-7q3x
- nvd: CVE-2025-36852
- https://github.com/nrwl/nx
- https://nx.app/files/cve-2025-06
- https://nx.dev/blog/creep-vulnerability-build-cache-security
- https://nx.dev/docs/reference/remote-cache-plugins/azure-cache/overview
CVE-2025-36852 · published · modified · JSON