Vulnerability · Published Nov 4, 2026 · Assigned by harborist
CVE-2026-121745nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command line
Low 2.5
In plain English
A low-severity security flaw in nvm from nvm-sh. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).
Official description
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when `NVM_AUTH_HEADER` is set, `nvm_download` passes the credential to curl or wget as a `--header "Authorization: ..."` command-line argument. Process arguments are visible to every local user (on Linux via `ps` or `/proc//cmdline` unless `/proc` is mounted with `hidepid=`; on macOS via `ps`), so another unprivileged account on the same machine can read the token while nvm is downloading during `nvm ls-remote`, `nvm install`, and similar commands, and gain whatever access it grants on the private mirror. Only users who set `NVM_AUTH_HEADER` on a host shared with other local accounts are affected. Version 0.41.0 passes the header to curl on stdin and to GNU Wget in a private temporary config file. BusyBox wget reads no config file, so when it is the only downloader available the header is still passed as an argument.
Affected products (as reported)
Weakness: CWE-214 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- GHSA-h3c2-g6gc-6cgx vendor-advisory
- Fix commit 903e3493 patch