nvm-sh
- Total products in the ecosystem
- 1
- Total vulnerabilities (90 days)
- 9
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/13/2026, nvm-sh recorded 9 security vulnerabilities in the last 90 days across 1 products, including 1 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, nvm had the most security vulnerabilities in the nvm-sh ecosystem, with 9 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-121751nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliasesCVE-2026-121750nvm install --offline installs a cached tarball that previously failed checksum verificationCVE-2026-121749nvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options and read local filesCVE-2026-121748nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes world-writableCVE-2026-121747nvm prints the contents of any readable file through a symlinked .nvmrc12 Results | Page 1 of 1
| SeverityLow |
| SeverityMedium |
| SeverityLow |
| SeverityMedium |
| SeverityMedium |
| SeverityLow |
| SeverityHigh |
| SeverityMedium |
| SeverityLow |
| SeverityHigh |
| SeverityMedium |