Is CVE-2026-104854 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104854 being exploited in the wild.

How severe is CVE-2026-104854?

High severity, with a CVSS score of 4, published 2 October 2026.

Which products and versions are affected?

nx (npm) SEMVER:introduced=14.6.0,fixed=22.7.9; Nrwl Nx 14.6.0 through 22.7.8 and 23.1.1.

How is CVE-2026-104854 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-104854?

Check whether you run nx (npm) or Nrwl Nx at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104854: Nx monorepo daemon and plugin worker socket privilege escalation

CVE-2026-104854 · Severity: high · CVSS 4 · Published 2026-10-02

Nx is a build tool for managing TypeScript and multi-language projects. On shared machines or in multi-user containers, unprivileged users can discover and connect to Nx daemon sockets created with world-readable permissions, then execute arbitrary code by controlling module files loaded by the daemon, or steal workspace and project configuration data.

Technologies: nx (npm), Nrwl Nx. Vendors: npm, Nrwl.

Quick answers

Is CVE-2026-104854 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104854 being exploited in the wild.
How severe is CVE-2026-104854?: High severity, with a CVSS score of 4, published 2 October 2026.
Which products and versions are affected?: nx (npm) SEMVER:introduced=14.6.0,fixed=22.7.9; Nrwl Nx 14.6.0 through 22.7.8 and 23.1.1.
Is there a fix for CVE-2026-104854?: Yes. nx (npm): upgrade to 22.7.9 or later. Until then: Avoid running Nx on shared systems or in multi-user containers with untrusted local accounts. Disable the Nx daemon using the environment variable or configuration flag if multiuser access cannot be prevented, though this does not fully mitigate the plugin worker socket exposure. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104854 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-104854?: Check whether you run nx (npm) or Nrwl Nx at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nx (npm): upgrade to 22.7.9 or later
```
npm install nx@22.7.9
```

Avoid running Nx on shared systems or in multi-user containers with untrusted local accounts. Disable the Nx daemon using the environment variable or configuration flag if multiuser access cannot be prevented, though this does not fully mitigate the plugin worker socket exposure.

Technical details

Nx daemon and plugin worker processes create Unix domain sockets in shared temporary directories with insufficient permission restrictions (no owner-only mode set). Socket endpoints perform no authentication, instead relying solely on filesystem access control. An attacker on the same machine can enumerate sockets, connect to them, and invoke the PROCESS_IN_BACKGROUND handler to load and execute arbitrary code, or call other handlers to leak workspace graphs, file contents, and task hashes.

Affected products

Nrwl Nx 14.6.0 through 22.7.8 and 23.1.1

Identifiers

CVE-2026-104854
GHSA-w3vv-58gj-gw77

Timeline

2026-10-02: disclosed
2026-08-07: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.