CVE-2026-71476: Nrwl Nx path traversal in self-hosted remote cache

CVE-2026-71476 · Severity: high · CVSS 4 · Published 2026-08-06

Nx, a popular build system tool, contains a vulnerability in its self-hosted remote caching feature. If an organization uses a custom or compromised remote cache server, an attacker could send a malicious file that overwrites critical system files on the developer's machine or build server. This could lead to a complete system takeover, unauthorized data access, or the execution of malicious code during the build process.

Technologies: Nrwl Nx. Vendors: npm, Nrwl.

Quick answers

Is CVE-2026-71476 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-71476 being exploited in the wild.
How severe is CVE-2026-71476?
High severity, with a CVSS score of 4, published 6 August 2026.
Which products and versions are affected?
@nx/azure-cache (npm) <= 5.0.7, SEMVER:introduced=0,last_affected=5.0.7; @nx/gcs-cache (npm) <= 5.0.7, SEMVER:introduced=0,last_affected=5.0.7; @nx/powerpack-azure-cache (npm) <= 5.0.7, SEMVER:introduced=0,last_affected=5.0.7; @nx/powerpack-gcs-cache (npm) <= 5.0.7, SEMVER:introduced=0,last_affected=5.0.7; and 9 more.
Is there a fix for CVE-2026-71476?
A patch was published on 2026-06-26: Fix merged in PR #36116 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71476 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-71476?
Check whether you run @nx/azure-cache (npm), @nx/gcs-cache (npm), @nx/powerpack-azure-cache (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (Zip-Slip) exists in the Nx self-hosted HTTP remote cache extractor. The vulnerable component fails to validate entry paths within downloaded gzipped tar archives, joining untrusted entry names directly to the output directory using an unguarded 'Entry::unpack()' call. An attacker controlling a remote cache server or performing a Man-in-the-Middle (MITM) attack can provide a crafted archive to write files outside the intended cache directory. This can be escalated to remote code execution (RCE) on the client machine. The issue is patched in Nx versions 22.7.7 and 23.0.2, while several standalone cache packages (@nx/s3-cache, etc.) are deprecated and remain vulnerable.

Affected products

  • nrwl nx >= 20.8.0, < 22.7.7; >= 23.0.0, < 23.0.2
  • nrwl @nx/s3-cache <= 5.0.7
  • nrwl @nx/gcs-cache <= 5.0.7
  • nrwl @nx/azure-cache <= 5.0.7
  • nrwl @nx/shared-fs-cache <= 5.0.7

Identifiers

  • CVE-2026-71476
  • GHSA-vp3h-ghgh-jr7g

Timeline

  • 2026-06-26: patched: Fix merged in PR #36116
  • 2026-07-10: disclosed: Advisory published by FrozenPandaz
  • 2026-08-06: advisory: Published to GitHub Advisory Database

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.