CVE-2026-121750

Name of the Vulnerable Software and Affected Versions Node Version Manager (nvm) versions 0.40.5 through 0.40.8

Description The nvm download artifact function downloads a release archive to $NVM DIR/.cache and verifies the checksum after the download is complete. If a checksum mismatch occurs, the system reports an error but retains the rejected archive in the cache. A subsequent nvm install --offline command for the same version installs the cached file without performing a checksum verification. This allows an attacker who can modify the downloaded tarball, such as through a poisoned CDN or cache object, to achieve code execution when the victim runs the offline installation after a failed checksum attempt.

Recommendations Update Node Version Manager (nvm) to version 0.41.0.