Threats tagged 'brew-nx-cve-2026-71476'

Nx's self-hosted HTTP remote cache has a Zip-Slip vulnerability (CVE-2026-71476) that allows a malicious or MITM remote cache server to craft tar archives that write files outside the intended cache directory, potentially leading to remote code execution. This affects Nx versions from 21.0.4 up to but not including 23.0.2. The default local cache and Nx Cloud are not affected. The vulnerability is fixed in Nx 23.0.2. Deprecated self-hosted cache packages remain vulnerable and should be migrated off.