CVE-2026-121745

Name of the Vulnerable Software and Affected Versions Node Version Manager (nvm) versions 0.40.0 through 0.40.8

Description When the NVM AUTH HEADER variable is set, the nvm download() function passes credentials to curl or wget as a command-line argument. Because process arguments are visible to all local users on Linux and macOS, an unprivileged account on the same machine can read the token during the execution of commands such as nvm ls-remote and nvm install. This allows the attacker to gain unauthorized access to the private mirror. This issue specifically affects users who set NVM AUTH HEADER on hosts shared with other local accounts.

Recommendations Update Node Version Manager (nvm) to version 0.41.0. As a temporary mitigation, avoid setting the NVM AUTH HEADER variable on systems shared with other local users.