Read the docs
TI-2026-85213 Aliases CVE-2026-121745

nvm passes auth header in command line visible to local users

Priority LOW 10CWE-214Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Node Version Manager (nvm) from 0.40.0 before 0.41.0 passes the NVM_AUTH_HEADER credential to curl or wget as a command-line argument, which exposes it in the process list (CWE-214). A local user with an unprivileged account on the same host can read the token while nvm downloads during commands such as nvm ls-remote or nvm install, and use the access it grants on the private mirror. Only hosts where NVM_AUTH_HEADER is set and shared with other local accounts are affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when `NVM_AUTH_HEADER` is set, `nvm_download` passes the credential to curl or wget as a `--header "Authorization: ..."` command-line argument. Process arguments are visible to every local user (on Linux via `ps` or `/proc//cmdline` unless `/proc` is mounted with `hidepid=`; on macOS via `ps`), so another unprivileged account on the same machine can read the token while nvm is downloading during `nvm ls-remote`, `nvm install`, and similar commands, and gain whatever access it grants on the private mirror. Only users who set `NVM_AUTH_HEADER` on a host shared with other local accounts are affected. Version 0.41.0 passes the header to curl on stdin and to GNU Wget in a private temporary config file. BusyBox wget reads no config file, so when it is the only downloader available the header is still passed as an argument.

Why it matters now

EPSS 0.00122 2nd percentileScored 2026-11-07
Fix Fixed nvm (nvm-sh): 0.41.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
nvm-shnvm0.40.0 to before 0.41.00.41.0Patch availableCNA
  • nvm Vendornvm-sh Affected 0.40.0 to before 0.41.0 Fixed in 0.41.0 Patch available CNA

Remediation

Upgrade nvm to version 0.41.0, which passes the header to curl on stdin and to GNU Wget in a private temporary config file. BusyBox wget reads no config file, so when it is the only downloader available the header is still passed as an argument.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

  • Fix · CNA nvm (nvm-sh) Fixed in 0.41.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    nvm-sh nvm 0.41.0

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2026-85227 nvm prints contents of arbitrary files through a symlinked .nvmrcPriority LOW 29
    • TI-2026-85226 nvm --save follows symlinked .nvmrc and overwrites filesPriority LOW 29
    • TI-2026-85228 nvm passes .nvmrc contents to grep, leaking local filesPriority LOW 20
    Show all 7 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-121745
  2. 2026-11-07 Affected versions changed · Red Hat
  3. 2026-11-07 CVSS score added · Red Hat

References

Patch 1

Advisory 1

  • TI-2026-13337 nvm path traversal via a malicious mirror's LTS codename writes outside the alias directory CVSS 4.0LOW 2.1
  • TI-2026-82282 Command injection in nvm lets version strings run arbitrary commands CVSS 4.0HIGH 7.1
  • TI-2026-85227 nvm prints contents of arbitrary files through a symlinked .nvmrc CVSS 4.0MEDIUM 6.7
  • TI-2026-85226 nvm --save follows symlinked .nvmrc and overwrites files CVSS 4.0MEDIUM 6.7
  • TI-2026-63368 nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias CVSS 4.0MEDIUM 6.7
  • TI-2026-01349 Command Injection in nvm via NVM_AUTH_HEADER in wget code path CVSS 4.0MEDIUM 5.4
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences