npm/@nx/s3-cache CVE-2026-71476: high, EPSS 0.86%
Nx: Zip-Slip in the self-hosted remote cache
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 5.0.7 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-vp3h-ghgh-jr7g#npm/@nx/s3-cache
- https://github.com/nrwl/nx/security/advisories/GHSA-vp3h-ghgh-jr7g
- https://github.com/nrwl/nx/pull/36116
- https://github.com/nrwl/nx/commit/2b20c2da39d263c32ae05767577589481a309fee
- https://github.com/nrwl/nx/commit/a82807621e4176e37909d2c1afede661b45cc30
- https://github.com/nrwl/nx/commit/ad296578fe980a4aad66f8af0add21f6ddf907d9
- https://github.com/nrwl/nx
CVE-2026-71476 · published · modified · JSON