CVE-2026-71476Published
Nx is a monorepo solution for TypeScript and polyglot codebases. From version 20.8.0 until 22.7.7 and 23.0.2, the Nx self-hosted HTTP remote cache extracts downloaded cache artifacts without constraining where files are written. A malicious…
Exact source revision recorded 25 Oct 2026 15:18:57 UTC. It does not establish the source's current position. Latest evidence.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-71476 · Microsoft / collected KEV context
nvd · CVE-2026-71476
- https://github.com/nrwl/nx/commit/2b20c2da39d263c32ae05767577589481a309fee
- https://github.com/nrwl/nx/commit/a82807621e4176e37909d2c1afede661b45cc30
- https://github.com/nrwl/nx/commit/ad296578fe980a4aad66f8af0add21f6ddf907d9
- https://github.com/nrwl/nx/pull/36116
- https://github.com/nrwl/nx/security/advisories/GHSA-vp3h-ghgh-jr7g
Current operational correlations are not mixed into this historical source record. Open latest evidence to discover current connections.