Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-121750— nvm install --offline installs a cached tarball that previously failed checksum verification

Quick assessment

Affected
nvm-sh nvm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Node Version Manager（nvm）是一个符合 POSIX 标准的 shell 函数，用于管理多个 Node.js 版本。在 0.40.5 至 0.40.8 版本中， 会将发布归档文件直接下载到 的最终路径，并在之后验证其校验和；若校验和不匹配，则报告错误，但被拒绝的归档文件仍保留在原处。随后，若用户对同一版本执行 ，该命令会从缓存中安装该文件且不再进行校验和验证，导致刚刚被拒绝的归档文件被安装并运行其 和 组件。 这为能够篡改下载归档文件（例如通过投毒的 CDN 或缓存对象）但无法伪造其旁边的 文件

CVSS 3.1 · Low
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-121750

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
nvm install --offline installs a cached tarball that previously failed checksum verification
Source: CVE Program / CVE List V5
Vulnerability Description
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.5 through 0.40.8, `nvm_download_artifact` downloads a release archive directly to its final path in `$NVM_DIR/.cache` and verifies its checksum afterwards; on a checksum mismatch it reports an error but leaves the rejected archive in place. A later `nvm install --offline` of the same version installs that cached file without a checksum, so an archive that was just rejected gets installed and its `node` and `npm` run. This gives code execution to a party who can alter the downloaded tarball (for example a poisoned CDN or cache object) but cannot also forge the `SHASUMS256.txt` beside it, if the victim runs `nvm install --offline` for that version after the visible "Checksums do not match" failure and before any online retry. Version 0.41.0 only puts an archive in the cache once its checksum has passed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
下载代码缺少完整性检查
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nvm-sh nvm 0.40.5 ~ 0.41.0 -

II. Public POCs for CVE-2026-121750

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-121750

请登录查看更多情报信息。

Other References for CVE-2026-121750 (2)

Same Patch Batch · nvm-sh · 2026-11-04 · 7 CVEs total

CVE-2026-121746 5.5 MEDIUM nvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any fi
CVE-2026-121747 5.5 MEDIUM nvm prints the contents of any readable file through a symlinked .nvmrc
CVE-2026-121748 3.6 LOW nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes worl
CVE-2026-121749 3.3 LOW nvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options an
CVE-2026-121751 3.1 LOW nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via store
CVE-2026-121745 2.5 LOW nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command line

IV. Related Vulnerabilities

Same product: nvm
Same vendor: nvm-sh
Same weakness: CWE-494