{"action":"Upgrade nx to 22.7.7 or later.","affected":[{"fixed":"22.7.7","introduced":"20.8.0"},{"fixed":"23.0.2","introduced":"23.0.0"}],"component":"nx","cve_ids":["CVE-2026-71476"],"ecosystem":"npm","epss":0.00865,"exploited":false,"fixed_versions":["22.7.7","23.0.2"],"ghsa_id":"GHSA-vp3h-ghgh-jr7g","id":"tcs_01M5KGCE9KPCM0T0R89Q876BZN","modified_at":"2026-08-06T20:25:59.560723Z","published_at":"2026-08-06T20:10:03Z","references":["https://osv.dev/vulnerability/GHSA-vp3h-ghgh-jr7g","https://github.com/nrwl/nx/security/advisories/GHSA-vp3h-ghgh-jr7g","https://github.com/nrwl/nx/pull/36116","https://github.com/nrwl/nx/commit/2b20c2da39d263c32ae05767577589481a309fee","https://github.com/nrwl/nx/commit/a82807621e4176e37909d2c1afede661b45cc30","https://github.com/nrwl/nx/commit/ad296578fe980a4aad66f8af0add21f6ddf907d9","https://github.com/nrwl/nx"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-vp3h-ghgh-jr7g","url":"https://osv.dev/vulnerability/GHSA-vp3h-ghgh-jr7g"}],"summary":"Nx: Zip-Slip in the self-hosted remote cache"}