Security Advisory catalog CVE-2026-71476 CVE-2026-71476 Published
Nx: Zip-Slip in the self-hosted remote cache Overview Affected History Connections
cve-program · CVE-2026-71476 Published nx Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "nrwl",
"product": "nx",
"versions": [
{
"version": ">= 20.8.0, < 22.7.7",
"status": "affected"
},
{
"version": ">= 23.0.0, < 23.0.2",
"status": "affected"
}
]
}
nvd · CVE-2026-71476 Published No affected-package array is stated in this source revision. Check its state and earlier observations; this does not establish that every package is unaffected.
osv · GHSA-vp3h-ghgh-jr7g Published nx npm
SEMVER · introduced 20.8.0 → fixed 22.7.7
@nx/s3-cache npm
SEMVER · introduced 0 → last_affected 5.0.7
@nx/gcs-cache npm
SEMVER · introduced 0 → last_affected 5.0.7
@nx/azure-cache npm
SEMVER · introduced 0 → last_affected 5.0.7
@nx/shared-fs-cache npm
SEMVER · introduced 0 → last_affected 5.0.7
@nx/powerpack-s3-cache npm
SEMVER · introduced 0 → last_affected 5.0.7
@nx/powerpack-gcs-cache npm
SEMVER · introduced 0 → last_affected 5.0.7
@nx/powerpack-azure-cache npm
SEMVER · introduced 0 → last_affected 5.0.7
@nx/powerpack-shared-fs-cache npm
SEMVER · introduced 0 → last_affected 5.0.7
nx npm
SEMVER · introduced 23.0.0 → fixed 23.0.2