CVE-2026-71476Published
Nx: Zip-Slip in the self-hosted remote cache
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-71476 · Microsoft / collected KEV context
cve-program · CVE-2026-71476
- https://github.com/nrwl/nx/security/advisories/GHSA-vp3h-ghgh-jr7g
- https://github.com/nrwl/nx/pull/36116
- https://github.com/nrwl/nx/commit/2b20c2da39d263c32ae05767577589481a309fee
- https://github.com/nrwl/nx/commit/a82807621e4176e37909d2c1afede661b45cc30
- https://github.com/nrwl/nx/commit/ad296578fe980a4aad66f8af0add21f6ddf907d9
nvd · CVE-2026-71476
- https://github.com/nrwl/nx/commit/2b20c2da39d263c32ae05767577589481a309fee
- https://github.com/nrwl/nx/commit/a82807621e4176e37909d2c1afede661b45cc30
- https://github.com/nrwl/nx/commit/ad296578fe980a4aad66f8af0add21f6ddf907d9
- https://github.com/nrwl/nx/pull/36116
- https://github.com/nrwl/nx/security/advisories/GHSA-vp3h-ghgh-jr7g
osv · GHSA-vp3h-ghgh-jr7g
- https://github.com/nrwl/nx/security/advisories/GHSA-vp3h-ghgh-jr7g
- https://github.com/nrwl/nx/pull/36116
- https://github.com/nrwl/nx/commit/2b20c2da39d263c32ae05767577589481a309fee
- https://github.com/nrwl/nx/commit/a82807621e4176e37909d2c1afede661b45cc30
- https://github.com/nrwl/nx/commit/ad296578fe980a4aad66f8af0add21f6ddf907d9
- https://github.com/nrwl/nx
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.