Nx: Zip-Slip in the self-hosted remote cache
Priority MEDIUM 47CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
Nx is a monorepo solution for TypeScript and polyglot codebases. From version 20.8.0 until 22.7.7 and 23.0.2, the Nx self-hosted HTTP remote cache extracts downloaded cache artifacts without constraining where files are written. A malicious or on-path (MITM) remote cache server can return a crafted tar archive whose entries escape the cache directory and write to arbitrary locations on the machine running Nx, which can be escalated to remote code execution. Nx's default local cache and Nx Cloud are not affected; only workspaces configured to use a self-hosted remote cache are affected. This issue is fixed in versions 22.7.7 and 23.0.2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00865 58th percentileScored 2026-11-07
Fix Fixed nx (nrwl): 22.7.7, 23.0.2nx (npm): 22.7.7, 23.0.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nrwl | nx | 20.8.0 to before 22.7.7; 23.0.0 to before 23.0.2 | 22.7.7, 23.0.2 | Patch available | CNA |
| — | nx (npm) | 20.8.0 to before 22.7.7 | 22.7.7 | Patch available | GHSA-vp3h-ghgh-jr7g |
| — | @nx/s3-cache (npm) | up to 5.0.7 | — | No fix listed | GHSA-vp3h-ghgh-jr7g |
| — | @nx/gcs-cache (npm) | up to 5.0.7 | — | No fix listed | GHSA-vp3h-ghgh-jr7g |
| — | @nx/azure-cache (npm) | up to 5.0.7 | — | No fix listed | GHSA-vp3h-ghgh-jr7g |
| — | @nx/shared-fs-cache (npm) | up to 5.0.7 | — | No fix listed | GHSA-vp3h-ghgh-jr7g |
| — | @nx/powerpack-s3-cache (npm) | up to 5.0.7 | — | No fix listed | GHSA-vp3h-ghgh-jr7g |
| — | @nx/powerpack-gcs-cache (npm) | up to 5.0.7 | — | No fix listed | GHSA-vp3h-ghgh-jr7g |
| — | @nx/powerpack-azure-cache (npm) | up to 5.0.7 | — | No fix listed | GHSA-vp3h-ghgh-jr7g |
| — | @nx/powerpack-shared-fs-cache (npm) | up to 5.0.7 | — | No fix listed | GHSA-vp3h-ghgh-jr7g |
| — | nx (npm) | 23.0.0 to before 23.0.2 | 23.0.2 | Patch available | GHSA-vp3h-ghgh-jr7g |
- nx Vendornrwl Affected 20.8.0 to before 22.7.7; 23.0.0 to before 23.0.2 Fixed in 22.7.7, 23.0.2 Patch available CNA
- nx (npm) Vendor— Affected 20.8.0 to before 22.7.7 Fixed in 22.7.7 Patch available GHSA-vp3h-ghgh-jr7g
- @nx/s3-cache (npm) Vendor— Affected up to 5.0.7 Fixed in — No fix listed GHSA-vp3h-ghgh-jr7g
- @nx/gcs-cache (npm) Vendor— Affected up to 5.0.7 Fixed in — No fix listed GHSA-vp3h-ghgh-jr7g
- @nx/azure-cache (npm) Vendor— Affected up to 5.0.7 Fixed in — No fix listed GHSA-vp3h-ghgh-jr7g
- @nx/shared-fs-cache (npm) Vendor— Affected up to 5.0.7 Fixed in — No fix listed GHSA-vp3h-ghgh-jr7g
- @nx/powerpack-s3-cache (npm) Vendor— Affected up to 5.0.7 Fixed in — No fix listed GHSA-vp3h-ghgh-jr7g
- @nx/powerpack-gcs-cache (npm) Vendor— Affected up to 5.0.7 Fixed in — No fix listed GHSA-vp3h-ghgh-jr7g
- @nx/powerpack-azure-cache (npm) Vendor— Affected up to 5.0.7 Fixed in — No fix listed GHSA-vp3h-ghgh-jr7g
- @nx/powerpack-shared-fs-cache (npm) Vendor— Affected up to 5.0.7 Fixed in — No fix listed GHSA-vp3h-ghgh-jr7g
- nx (npm) Vendor— Affected 23.0.0 to before 23.0.2 Fixed in 23.0.2 Patch available GHSA-vp3h-ghgh-jr7g
Remediation
- Fix · CNA nx (nrwl) Fixed in 22.7.7, 23.0.2
- Fix · GHSA-vp3h-ghgh-jr7g nx (npm) Fixed in 22.7.7 Advisory →
- Fix · GHSA-vp3h-ghgh-jr7g nx (npm) Fixed in 23.0.2 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Critical. Red Hat's page for this CVE →
Not affected: 4 products
- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Hardened Images
Timeline
- 2026-10-02 Threatist record created from CVE-2026-71476
- 2026-10-03 Alias added: GHSA-vp3h-ghgh-jr7g
References
Other 6
- https://github.com/nrwl/nx/security/advisories/GHSA-vp3h-ghgh-jr7g
- https://github.com/nrwl/nx/pull/36116
- https://github.com/nrwl/nx/commit/2b20c2da39d263c32ae05767577589481a309fee
- https://github.com/nrwl/nx/commit/a82807621e4176e37909d2c1afede661b45cc30
- https://github.com/nrwl/nx/commit/ad296578fe980a4aad66f8af0add21f6ddf907d9
- https://github.com/nrwl/nx
More nrwl vulnerabilities
- TI-2026-66138 Nx daemon and plugin worker sockets are accessible to other local users CVSS 4.0HIGH 8.5
- TI-2026-82771 OS command injection in Nx @nx/maven and @nx/gradle via nx.json CVSS 4.0HIGH 7.3
- TI-2026-66140 Nx: OS command injection in the @nx/docker release pipeline CVSS 4.0HIGH 7.3
- TI-2026-39559 Nx: `nx graph` dev server permissive CORS policy CVSS 3.1MEDIUM 5.9
- TI-2026-66137 Nx: Path traversal in nx migrate package-migrations extraction CVSS 4.0MEDIUM 5.8
Sources
- CVE-2026-71476 · CVE Program
- CVE-2026-71476 · NVD
- FIRST EPSS
- GHSA-vp3h-ghgh-jr7g · GitHub Advisory Database · CC BY 4.0
- CVE-2026-71476 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences