CVE-2026-121745

Overview

Node Version Manager (nvm) versions 0.40.0 through 0.40.8 expose authentication credentials in process arguments when downloading from private mirrors. This allows other local users on the same system to read the token via standard process inspection tools. The issue is resolved in version 0.41.0 by passing headers via stdin or private config files.

Description

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when `NVM_AUTH_HEADER` is set, `nvm_download` passes the credential to curl or wget as a `--header "Authorization: ..."` command-line argument. Process arguments are visible to every local user (on Linux via `ps` or `/proc//cmdline` unless `/proc` is mounted with `hidepid=`; on macOS via `ps`), so another unprivileged account on the same machine can read the token while nvm is downloading during `nvm ls-remote`, `nvm install`, and similar commands, and gain whatever access it grants on the private mirror. Only users who set `NVM_AUTH_HEADER` on a host shared with other local accounts are affected. Version 0.41.0 passes the header to curl on stdin and to GNU Wget in a private temporary config file. BusyBox wget reads no config file, so when it is the only downloader available the header is still passed as an argument.

Impact

Confidentiality is compromised for local users on shared systems who can observe process arguments. The impact is limited to environments where nvm is used with the NVM_AUTH_HEADER variable on multi-user hosts. Attackers can gain access to the private Node.js mirror using the exposed token. Integrity and availability are not directly affected by this vulnerability.

Remediation

Upgrade nvm to version 0.41.0 or later. If upgrading is not immediately possible, avoid setting NVM_AUTH_HEADER on shared multi-user systems. Alternatively, configure /proc with the hidepid mount option on Linux to restrict process visibility to other users. Ensure that only trusted local accounts have access to the host if the environment variable must be used.

Risk context

The vulnerability has a low severity rating (CVSS v3: 2.5) and no EPSS score is available. The risk is low for single-user systems but moderate for shared development or CI/CD environments where multiple unprivileged users exist. Patching is recommended as part of routine maintenance rather than emergency response.

Affected products

• nvm 0.40.0
• nvm 0.40.1
• nvm 0.40.2
• nvm 0.40.3
• nvm 0.40.4
• nvm 0.40.5
• nvm 0.40.6
• nvm 0.40.7