CVE-2026-121745

Received Received - Intake

Information Disclosure in Node Version Manager

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: harborist

Description

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when `NVM_AUTH_HEADER` is set, `nvm_download` passes the credential to curl or wget as a `--header "Authorization: ..."` command-line argument. Process arguments are visible to every local user (on Linux via `ps` or `/proc//cmdline` unless `/proc` is mounted with `hidepid=`; on macOS via `ps`), so another unprivileged account on the same machine can read the token while nvm is downloading during `nvm ls-remote`, `nvm install`, and similar commands, and gain whatever access it grants on the private mirror. Only users who set `NVM_AUTH_HEADER` on a host shared with other local accounts are affected. Version 0.41.0 passes the header to curl on stdin and to GNU Wget in a private temporary config file. BusyBox wget reads no config file, so when it is the only downloader available the header is still passed as an argument.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-121745

EUVD

EUVD-2026-117127

Affected Vendors & Products

Vendor	Product	Version / Range
nvm-sh	nvm	0.40.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-214	A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.

Attack-Flow Graph

Executive Summary

This vulnerability affects Node Version Manager (nvm) versions 0.40.0 through 0.40.8. When the NVM_AUTH_HEADER is set, nvm passes credentials to curl or wget as a command-line argument. These arguments are visible to other local users on the same machine, potentially exposing the token to unauthorized access.

Detection Guidance

Check if NVM_AUTH_HEADER is set in your environment. Run 'env | grep NVM_AUTH_HEADER' to see if the variable exists. Inspect running processes for nvm commands using 'ps aux | grep nvm' or check /proc/[pid]/cmdline for argument visibility. Verify if /proc is mounted with hidepid= by running 'mount | grep hidepid'.

Impact Analysis

If you share a host with other local accounts and use nvm with NVM_AUTH_HEADER set, another unprivileged user could read your credentials during operations like nvm ls-remote or nvm install. This could grant them access to private mirrors or repositories protected by the token.

Mitigation Strategies

Upgrade nvm to version 0.41.0 or later. Remove or unset NVM_AUTH_HEADER from your environment. Avoid sharing accounts on the same host. If using shared systems, ensure /proc is mounted with hidepid=1 to restrict process visibility.

Hi! I’m here to help you understand CVE-2026-121745. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...