CVE-2026-71476
CVE-2026-71476 updated by NVD
Summary
Nx is a monorepo solution for TypeScript and polyglot codebases. From version 20.8.0 until 22.7.7 and 23.0.2, the Nx self-hosted HTTP remote cache extracts downloaded cache artifacts without constraining where files are written. A malicious or on-path (MITM) remote cache server can return a crafted tar archive whose entries escape the cache directory and write to arbitrary locations on the machine running Nx, which can be escalated to remote code execution. Nx's default local cache and Nx Cloud are not affected; only workspaces configured to use a self-hosted remote cache are affected. This issue is fixed in versions 22.7.7 and 23.0.2.
Affected packages
| Ecosystem | Package | Affected versions | Fixed versions |
|---|---|---|---|
| npm | @nx/azure-cache | — | — |
| npm | @nx/gcs-cache | — | — |
| npm | @nx/powerpack-azure-cache | — | — |
| npm | @nx/powerpack-gcs-cache | — | — |
| npm | @nx/powerpack-s3-cache | — | — |
| npm | @nx/powerpack-shared-fs-cache | — | — |
| npm | @nx/s3-cache | — | — |
| npm | @nx/shared-fs-cache | — | — |
| npm | nx | — | 22.7.7, 23.0.2 |
Remediation: No patched version is listed by GitHub.
References
Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.
Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.
CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.
EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.