CVE-2026-121750 in nvm
Summary
by MITRE • 11/05/2026
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.5 through 0.40.8, `nvm_download_artifact` downloads a release archive directly to its final path in `$NVM_DIR/.cache` and verifies its checksum afterwards; on a checksum mismatch it reports an error but leaves the rejected archive in place. A later `nvm install --offline` of the same version installs that cached file without a checksum, so an archive that was just rejected gets installed and its `node` and `npm` run. This gives code execution to a party who can alter the downloaded tarball (for example a poisoned CDN or cache object) but cannot also forge the `SHASUMS256.txt` beside it, if the victim runs `nvm install --offline` for that version after the visible "Checksums do not match" failure and before any online retry. Version 0.41.0 only puts an archive in the cache once its checksum has passed.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in Node Version Manager (nvm) versions 0.40.5 through 0.40.8 represents a critical integrity verification flaw within the artifact download and caching mechanism. nvm is widely used as a POSIX-compliant shell function for managing multiple node.js versions, making it a common tool in development environments across various operating systems. The core issue lies in the sequence of operations performed by the `nvm_download_artifact` function during version installation. In these affected versions, when downloading a release archive, nvm writes the file directly to its final destination path within the `$NVM_DIR/.cache` directory before performing any integrity checks. This design choice creates a race condition-like scenario where the cached artifact exists on disk prior to validation of its authenticity.
Upon completion of the download, nvm proceeds to verify the checksum against the expected values provided in the `SHASUMS256.txt` file associated with the release. If this verification fails due to a mismatch, indicating potential corruption or tampering, nvm correctly reports an error message stating that the checksums do not match and aborts the installation process from the perspective of the user interface. However, despite rejecting the archive for immediate use, the tool does not remove the downloaded file from the cache directory. This leaves behind a compromised or corrupted artifact in a location where subsequent operations may inadvertently utilize it without re-verifying its integrity.
The operational impact becomes severe when a developer subsequently attempts to install the same node.js version using the `--offline` flag. The offline installation mode is designed to speed up processes by utilizing previously downloaded artifacts rather than fetching them from remote servers again. In this specific scenario, nvm locates the cached archive for the requested version and proceeds to extract and execute it without performing any checksum verification or integrity checks. Consequently, if an attacker has managed to poison the CDN response or manipulate a cache object such that the initial download contains malicious code but fails the checksum check against the legitimate `SHASUMS256.txt`, the subsequent offline install will silently accept this poisoned archive. This results in arbitrary code execution within the context of the user running nvm, effectively bypassing the security controls intended to prevent the use of unverified software artifacts.
This vulnerability aligns with CWE-347, Improper Verification of Cryptographic Signature, as the system fails to ensure that only verified data is used for critical operations like installation and execution. Furthermore, it relates to CWE-502, Deserialization of Untrusted Data, if the tarball contains serialized payloads intended for exploitation during extraction or subsequent node.js runtime initialization. From an ATT&CK perspective, this flaw facilitates Supply Chain Compromise by allowing malicious artifacts introduced via a poisoned CDN or cache poisoning attack to be executed locally after bypassing integrity checks through offline mode misuse. It also touches upon Improper Input Validation since the system accepts cached data without re-validating its trustworthiness in specific operational modes.
The risk is particularly acute for developers who rely on nvm for managing multiple node.js versions and frequently switch between online and offline installation methods, or those working in environments with unreliable network connections where caching behavior is heavily utilized. An attacker capable of intercepting traffic to the official Node.js distribution servers or compromising a CDN edge node could inject malicious payloads into the release archives. While they cannot forge the accompanying `SHASUMS256.txt` file due to cryptographic protections, they can ensure that the archive itself contains malware. If the victim encounters a checksum mismatch error and then retries using offline mode before clearing the cache or retrying online, the malicious code is executed with full privileges of the user account running nvm.
To mitigate this vulnerability, users should immediately upgrade Node Version Manager to version 0.41.0 or later. The fix implemented in version 0.41.0 changes the caching logic so that an archive is only placed into the cache directory after its checksum has been successfully verified. This ensures that no unverified artifacts persist on disk, thereby eliminating the possibility of offline installations pulling compromised files from the cache. For users unable to upgrade immediately, manual deletion of the contents within `$NVM_DIR/.cache` for affected node.js versions is recommended before attempting any further installs. Additionally, developers should be cautious when using `--offline` flags and ensure that network connectivity allows for fresh integrity checks whenever possible, especially in environments where supply chain attacks are a known threat vector.