npm/nx CVE-2026-71476: high, EPSS 0.86%
Nx: Zip-Slip in the self-hosted remote cache
Action: Upgrade nx to 22.7.7 or later.
npm i nx@22.7.7npm i nx@23.0.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 20.8.0 | 22.7.7 | - |
| 23.0.0 | 23.0.2 | - |
Fixed versions
| 22.7.7 | 23.0.2 |
Sources
- osv: GHSA-vp3h-ghgh-jr7g
- https://github.com/nrwl/nx/security/advisories/GHSA-vp3h-ghgh-jr7g
- https://github.com/nrwl/nx/pull/36116
- https://github.com/nrwl/nx/commit/2b20c2da39d263c32ae05767577589481a309fee
- https://github.com/nrwl/nx/commit/a82807621e4176e37909d2c1afede661b45cc30
- https://github.com/nrwl/nx/commit/ad296578fe980a4aad66f8af0add21f6ddf907d9
- https://github.com/nrwl/nx
CVE-2026-71476 · published · modified · JSON