Read the docs
TI-2026-85215 Aliases CVE-2026-121750

nvm offline install reuses a tarball that failed checksum

Priority LOW 10CWE-459Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-494.

Summary

Node Version Manager (nvm) versions from 0.40.5 before 0.41.0 write downloaded release archives to the cache before checking their checksums, and keep an archive that fails verification. A later nvm install --offline of the same version installs that rejected archive without a checksum. An attacker who can alter the tarball but not forge the SHASUMS256.txt file beside it can run code if a victim runs that offline install after a checksum mismatch.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.5 through 0.40.8, `nvm_download_artifact` downloads a release archive directly to its final path in `$NVM_DIR/.cache` and verifies its checksum afterwards; on a checksum mismatch it reports an error but leaves the rejected archive in place. A later `nvm install --offline` of the same version installs that cached file without a checksum, so an archive that was just rejected gets installed and its `node` and `npm` run. This gives code execution to a party who can alter the downloaded tarball (for example a poisoned CDN or cache object) but cannot also forge the `SHASUMS256.txt` beside it, if the victim runs `nvm install --offline` for that version after the visible "Checksums do not match" failure and before any online retry. Version 0.41.0 only puts an archive in the cache once its checksum has passed.

Why it matters now

EPSS 0.00146 3rd percentileScored 2026-11-07
Fix Fixed nvm (nvm-sh): 0.41.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
nvm-shnvm0.40.5 to before 0.41.00.41.0Patch availableCNA
  • nvm Vendornvm-sh Affected 0.40.5 to before 0.41.0 Fixed in 0.41.0 Patch available CNA

Remediation

Upgrade nvm to version 0.41.0, which stores an archive in the cache only after its checksum passes.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

  • Fix · CNA nvm (nvm-sh) Fixed in 0.41.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    nvm-sh nvm 0.41.0

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2026-85227 nvm prints contents of arbitrary files through a symlinked .nvmrcPriority LOW 29
    • TI-2026-85226 nvm --save follows symlinked .nvmrc and overwrites filesPriority LOW 29
    • TI-2026-85228 nvm passes .nvmrc contents to grep, leaking local filesPriority LOW 20
    Show all 7 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-121750
  2. 2026-11-07 Affected versions changed · Red Hat
  3. 2026-11-07 CVSS score added · Red Hat

References

Patch 1

Advisory 1

  • TI-2026-13337 nvm path traversal via a malicious mirror's LTS codename writes outside the alias directory CVSS 4.0LOW 2.1
  • TI-2026-82282 Command injection in nvm lets version strings run arbitrary commands CVSS 4.0HIGH 7.1
  • TI-2026-85227 nvm prints contents of arbitrary files through a symlinked .nvmrc CVSS 4.0MEDIUM 6.7
  • TI-2026-85226 nvm --save follows symlinked .nvmrc and overwrites files CVSS 4.0MEDIUM 6.7
  • TI-2026-63368 nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias CVSS 4.0MEDIUM 6.7
  • TI-2026-01349 Command Injection in nvm via NVM_AUTH_HEADER in wget code path CVSS 4.0MEDIUM 5.4
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences