CVE-2026-121750 nvm install --offline installs a cached tarball that previously failed checksum verification
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-121750?
CVE-2026-121750 is a low-severity vulnerability in nvm-sh nvm, published on 4 Nov 2026.
Official description
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.5 through 0.40.8, `nvm_download_artifact` downloads a release archive directly to its final path in `$NVM_DIR/.cache` and verifies its checksum afterwards; on a checksum mismatch it reports an error but leaves the rejected archive in place. A later `nvm install --offline` of the same version installs that cached file without a checksum, so an archive that was just rejected gets installed and its `node` and `npm` run. This gives code execution to a party who can alter the downloaded tarball (for example a poisoned CDN or cache object) but cannot also forge the `SHASUMS256.txt` beside it, if the victim runs `nvm install --offline` for that version after the visible "Checksums do not match" failure and before any online retry. Version 0.41.0 only puts an archive in the cache once its checksum has passed.
Which versions are affected by CVE-2026-121750?
How do I fix CVE-2026-121750?
No fix has been published for CVE-2026-121750 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-121750 being exploited?
There is no known exploitation of CVE-2026-121750 in the wild and no public exploit code.
Sources
Also known as GHSA-262q-c465-prmr.