CVE-2026-71476
9 advisories.
npm/nx CVE-2026-71476: high, EPSS 0.86%
Nx: Zip-Slip in the self-hosted remote cache
Action: Upgrade nx to 22.7.7 or later.
npm i nx@22.7.7npm i nx@23.0.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 20.8.0 | 22.7.7 | - |
| 23.0.0 | 23.0.2 | - |
Fixed versions
| 22.7.7 | 23.0.2 |
Sources
- osv: GHSA-vp3h-ghgh-jr7g
- https://github.com/nrwl/nx/security/advisories/GHSA-vp3h-ghgh-jr7g
- https://github.com/nrwl/nx/pull/36116
- https://github.com/nrwl/nx/commit/2b20c2da39d263c32ae05767577589481a309fee
- https://github.com/nrwl/nx/commit/a82807621e4176e37909d2c1afede661b45cc30
- https://github.com/nrwl/nx/commit/ad296578fe980a4aad66f8af0add21f6ddf907d9
- https://github.com/nrwl/nx
CVE-2026-71476 · published · modified · JSON
npm/@nx/s3-cache CVE-2026-71476: high, EPSS 0.86%
Nx: Zip-Slip in the self-hosted remote cache
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 5.0.7 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-vp3h-ghgh-jr7g#npm/@nx/s3-cache
- https://github.com/nrwl/nx/security/advisories/GHSA-vp3h-ghgh-jr7g
- https://github.com/nrwl/nx/pull/36116
- https://github.com/nrwl/nx/commit/2b20c2da39d263c32ae05767577589481a309fee
- https://github.com/nrwl/nx/commit/a82807621e4176e37909d2c1afede661b45cc30
- https://github.com/nrwl/nx/commit/ad296578fe980a4aad66f8af0add21f6ddf907d9
- https://github.com/nrwl/nx
CVE-2026-71476 · published · modified · JSON
npm/@nx/gcs-cache CVE-2026-71476: high, EPSS 0.86%
Nx: Zip-Slip in the self-hosted remote cache
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 5.0.7 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-vp3h-ghgh-jr7g#npm/@nx/gcs-cache
- https://github.com/nrwl/nx/security/advisories/GHSA-vp3h-ghgh-jr7g
- https://github.com/nrwl/nx/pull/36116
- https://github.com/nrwl/nx/commit/2b20c2da39d263c32ae05767577589481a309fee
- https://github.com/nrwl/nx/commit/a82807621e4176e37909d2c1afede661b45cc30
- https://github.com/nrwl/nx/commit/ad296578fe980a4aad66f8af0add21f6ddf907d9
- https://github.com/nrwl/nx
CVE-2026-71476 · published · modified · JSON
npm/@nx/azure-cache CVE-2026-71476: high, EPSS 0.86%
Nx: Zip-Slip in the self-hosted remote cache
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 5.0.7 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-vp3h-ghgh-jr7g#npm/@nx/azure-cache
- https://github.com/nrwl/nx/security/advisories/GHSA-vp3h-ghgh-jr7g
- https://github.com/nrwl/nx/pull/36116
- https://github.com/nrwl/nx/commit/2b20c2da39d263c32ae05767577589481a309fee
- https://github.com/nrwl/nx/commit/a82807621e4176e37909d2c1afede661b45cc30
- https://github.com/nrwl/nx/commit/ad296578fe980a4aad66f8af0add21f6ddf907d9
- https://github.com/nrwl/nx
CVE-2026-71476 · published · modified · JSON
npm/@nx/shared-fs-cache CVE-2026-71476: high, EPSS 0.86%
Nx: Zip-Slip in the self-hosted remote cache
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 5.0.7 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-vp3h-ghgh-jr7g#npm/@nx/shared-fs-cache
- https://github.com/nrwl/nx/security/advisories/GHSA-vp3h-ghgh-jr7g
- https://github.com/nrwl/nx/pull/36116
- https://github.com/nrwl/nx/commit/2b20c2da39d263c32ae05767577589481a309fee
- https://github.com/nrwl/nx/commit/a82807621e4176e37909d2c1afede661b45cc30
- https://github.com/nrwl/nx/commit/ad296578fe980a4aad66f8af0add21f6ddf907d9
- https://github.com/nrwl/nx
CVE-2026-71476 · published · modified · JSON
npm/@nx/powerpack-s3-cache CVE-2026-71476: high, EPSS 0.86%
Nx: Zip-Slip in the self-hosted remote cache
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 5.0.7 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-vp3h-ghgh-jr7g#npm/@nx/powerpack-s3-cache
- https://github.com/nrwl/nx/security/advisories/GHSA-vp3h-ghgh-jr7g
- https://github.com/nrwl/nx/pull/36116
- https://github.com/nrwl/nx/commit/2b20c2da39d263c32ae05767577589481a309fee
- https://github.com/nrwl/nx/commit/a82807621e4176e37909d2c1afede661b45cc30
- https://github.com/nrwl/nx/commit/ad296578fe980a4aad66f8af0add21f6ddf907d9
- https://github.com/nrwl/nx
CVE-2026-71476 · published · modified · JSON
npm/@nx/powerpack-gcs-cache CVE-2026-71476: high, EPSS 0.86%
Nx: Zip-Slip in the self-hosted remote cache
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 5.0.7 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-vp3h-ghgh-jr7g#npm/@nx/powerpack-gcs-cache
- https://github.com/nrwl/nx/security/advisories/GHSA-vp3h-ghgh-jr7g
- https://github.com/nrwl/nx/pull/36116
- https://github.com/nrwl/nx/commit/2b20c2da39d263c32ae05767577589481a309fee
- https://github.com/nrwl/nx/commit/a82807621e4176e37909d2c1afede661b45cc30
- https://github.com/nrwl/nx/commit/ad296578fe980a4aad66f8af0add21f6ddf907d9
- https://github.com/nrwl/nx
CVE-2026-71476 · published · modified · JSON
npm/@nx/powerpack-azure-cache CVE-2026-71476: high, EPSS 0.86%
Nx: Zip-Slip in the self-hosted remote cache
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 5.0.7 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-vp3h-ghgh-jr7g#npm/@nx/powerpack-azure-cache
- https://github.com/nrwl/nx/security/advisories/GHSA-vp3h-ghgh-jr7g
- https://github.com/nrwl/nx/pull/36116
- https://github.com/nrwl/nx/commit/2b20c2da39d263c32ae05767577589481a309fee
- https://github.com/nrwl/nx/commit/a82807621e4176e37909d2c1afede661b45cc30
- https://github.com/nrwl/nx/commit/ad296578fe980a4aad66f8af0add21f6ddf907d9
- https://github.com/nrwl/nx
CVE-2026-71476 · published · modified · JSON
npm/@nx/powerpack-shared-fs-cache CVE-2026-71476: high, EPSS 0.86%
Nx: Zip-Slip in the self-hosted remote cache
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 5.0.7 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-vp3h-ghgh-jr7g#npm/@nx/powerpack-shared-fs-cache
- https://github.com/nrwl/nx/security/advisories/GHSA-vp3h-ghgh-jr7g
- https://github.com/nrwl/nx/pull/36116
- https://github.com/nrwl/nx/commit/2b20c2da39d263c32ae05767577589481a309fee
- https://github.com/nrwl/nx/commit/a82807621e4176e37909d2c1afede661b45cc30
- https://github.com/nrwl/nx/commit/ad296578fe980a4aad66f8af0add21f6ddf907d9
- https://github.com/nrwl/nx
CVE-2026-71476 · published · modified · JSON