{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"5.0.7"}],"component":"@nx/s3-cache","cve_ids":["CVE-2026-71476"],"ecosystem":"npm","epss":0.00865,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-vp3h-ghgh-jr7g","id":"tcs_01M5KGCEGYXTPAXYWFZRZ7TKFN","modified_at":"2026-08-06T20:25:59.560723Z","published_at":"2026-08-06T20:10:03Z","references":["https://osv.dev/vulnerability/GHSA-vp3h-ghgh-jr7g","https://github.com/nrwl/nx/security/advisories/GHSA-vp3h-ghgh-jr7g","https://github.com/nrwl/nx/pull/36116","https://github.com/nrwl/nx/commit/2b20c2da39d263c32ae05767577589481a309fee","https://github.com/nrwl/nx/commit/a82807621e4176e37909d2c1afede661b45cc30","https://github.com/nrwl/nx/commit/ad296578fe980a4aad66f8af0add21f6ddf907d9","https://github.com/nrwl/nx"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-vp3h-ghgh-jr7g#npm/@nx/s3-cache","url":"https://osv.dev/vulnerability/GHSA-vp3h-ghgh-jr7g"}],"summary":"Nx: Zip-Slip in the self-hosted remote cache"}