nx (npm)

Known vulnerabilities and malicious package reports for nx on npm, live from OSV, with CISA KEV exploitation status and EPSS scores.

Known package reports

1 malicious package report and 5 vulnerabilities returned by OSV. Check a specific version to see which reports apply.

If you installed a reported malicious release, remove it and rotate the credentials that machine could access. Upgrading does not undo code that already ran.

MAL-2025-41443: Malicious package report

Malicious code in nx (npm)

Published .

Updated .

Reported affected releases: 20.9.0, 20.10.0, 20.11.0, 20.12.0, 21.5.0, 21.6.0, 21.7.0, 21.8.0.

Severity: CRITICAL.

CVE-2025-10894

GHSA-g2r8-wvmj-jf5w: Vulnerability

`nx graph` dev server permissive CORS policy

Published .

Updated .

Affected ranges: introduced 17.0.4, fixed 22.7.2; introduced 23.0.0-beta.0, fixed 23.0.0-beta.2.

Fix versions reported by the advisory: 22.7.2, 23.0.0-beta.2.

Severity: MEDIUM.

CVE-2026-54753

GHSA-vp3h-ghgh-jr7g: Vulnerability

Nx: Zip-Slip in the self-hosted remote cache

Published .

Updated .

Affected ranges: introduced 20.8.0, fixed 22.7.7; introduced 23.0.0, fixed 23.0.2.

Fix versions reported by the advisory: 22.7.7, 23.0.2.

Severity: HIGH.

CVE-2026-71476

GHSA-hrvq-x7jp-36xv: Vulnerability

Nx: Path traversal in nx migrate package-migrations extraction

Published .

Updated .

Affected ranges: introduced 13.10.0, fixed 22.7.10; introduced 23.0.0, fixed 23.2.1.

Fix versions reported by the advisory: 22.7.10, 23.2.1.

Severity: MEDIUM.

CVE-2026-104853

GHSA-w3vv-58gj-gw77: Vulnerability

Nx daemon and plugin worker sockets are accessible to other local users

Published .

Updated .

Affected ranges: introduced 14.6.0, fixed 22.7.9; introduced 23.0.0, fixed 23.1.2.

Fix versions reported by the advisory: 22.7.9, 23.1.2.

Severity: HIGH.

CVE-2026-104854

GHSA-w2vw-w76x-qr89: Vulnerability

Nx: OS command injection via git revisions and remote refs

Published .

Updated .

Affected ranges: introduced 14.0.0, fixed 22.7.8; introduced 23.0.0, fixed 23.1.1.

Fix versions reported by the advisory: 22.7.8, 23.1.1.

Severity: HIGH.

Source: OSV, including OpenSSF malicious-package reports and GitHub advisories. No known report is not proof a package is safe.