CVE-2026-71476

Name of the Vulnerable Software and Affected Versions Nx versions 20.8.0 through 22.7.6 Nx versions 23.0.0 through 23.0.1 @nx/s3-cache (affected versions not specified) @nx/gcs-cache (affected versions not specified) @nx/azure-cache (affected versions not specified) @nx/shared-fs-cache (affected versions not specified)

Description The self-hosted HTTP remote cache extracts downloaded cache artifacts without constraining where files are written. A malicious or on-path (MITM) remote cache server can return a crafted tar archive whose entries escape the cache directory and write to arbitrary locations on the machine running Nx, which can be escalated to remote code execution. This occurs because the extractor joins untrusted tar entry names directly onto the output directory using an unguarded Entry::unpack() function that performs no containment check. Only workspaces configured to use a self-hosted remote cache, such as those using the NX SELF HOSTED REMOTE CACHE SERVER variable, are affected. Nx's default local cache and Nx Cloud are not affected.

Recommendations Upgrade Nx to version 22.7.7 or 23.0.2. Migrate away from the deprecated @nx/s3-cache, @nx/gcs-cache, @nx/azure-cache, and @nx/shared-fs-cache packages to Nx Cloud or the self-hosted OpenAPI/HTTP remote cache.