CVE-2026-121750

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.5 through 0.40.8, `nvm_download_artifact` downloads a release archive directly to its final path in `$NVM_DIR/.cache` and verifies its checksum afterwards; on a checksum mismatch it reports an error but leaves the rejected archive in place. A later `nvm install --offline` of the same version installs that cached file without a checksum, so an archive that was just rejected gets installed and its `node` and `npm` run. This gives code execution to a party who can alter the downloaded tarball (for example a poisoned CDN or cache object) but cannot also forge the `SHASUMS256.txt` beside it, if the victim runs `nvm install --offline` for that version after the visible "Checksums do not match" failure and before any online retry. Version 0.41.0 only puts an archive in the cache once its checksum has passed.

• CWE-459
• CWE-494

• https://github.com/nvm-sh/nvm/commit/1f99e4c20bb92c5737b92512446acf8e303b1edd
• https://github.com/nvm-sh/nvm/security/advisories/GHSA-262q-c465-prmr

Published

Nov 4, 2026

Last Modified

Nov 4, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-121745Node Version Manager (nvm) is a POSIX-compliant shell functi…2.5
• CVE-2026-121746Node Version Manager (nvm) is a POSIX-compliant shell functi…5.5
• CVE-2026-121747Node Version Manager (nvm) is a POSIX-compliant shell functi…5.5
• CVE-2026-121748Node Version Manager (nvm) is a POSIX-compliant shell functi…3.6
• CVE-2026-121749Node Version Manager (nvm) is a POSIX-compliant shell functi…3.3
• CVE-2026-12175A vulnerability was detected in CodeAstro Student Attendance…4.7
• CVE-2026-121751Node Version Manager (nvm) is a POSIX-compliant shell functi…3.1
• CVE-2026-12176A vulnerability has been found in SourceCodester CET Automat…4.3
• CVE-2026-1218A vulnerability was detected in Bjskzy Zhiyou ERP up to 11.0…6.3
• CVE-2026-121802@better-auth/expo before 1.7.16 allows certain account-takeo…9.1
• CVE-2026-121803Rejected reason: This CVE ID is a duplicate of CVE-2026-8033…
• CVE-2026-121816Herowatch Mini developed by About Time Technologies has a Mi…8.8