CVE-2026-121750: nvm install --offline installs a cached tarball that previously failed checksum verification
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.5 through 0.40.8, nvmdownloadartifact downloads a release archive directly to its final path in $NVMDIR/.cache and verifies its checksum afterwards; on a checksum mismatch it reports an error but leaves the rejected archive in place. A later nvm install --offline of the same version installs that cached file without a checksum, so an archive that was just rejected gets installed and its node and npm run. This gives code execution to a party who can alter the downloaded tarball (for example a poisoned CDN or cache object) but cannot also forge the SHASUMS256.txt beside it, if the victim runs nvm install --offline for that version after the visible "Checksums do not match" failure and before any online retry. Version 0.41.0 only puts an archive in the cache once its checksum has passed.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nvmto a version that resolves this vulnerability.Fixed in 0.41.0
Event History
Frequently Asked Questions
Which installations are exposed to this issue?
nvm versions 0.40.5 through 0.40.8 are affected. Exploitation also requires a user to run `nvm install --offline` for the same version after a checksum-mismatch download failure and before an online retry.
What must an attacker be able to do?
An attacker must be able to alter the downloaded release tarball, such as through a poisoned CDN or cache object. They do not need to forge the corresponding `SHASUMS256.txt`, because the later offline installation does not revalidate the cached archive.
What should be done if upgrading is not immediately possible?
Do not run `nvm install --offline` for a version whose prior download reported "Checksums do not match." Remove the rejected archive from `$NVM_DIR/.cache` and obtain the release again online so its checksum is verified.
How can I tell whether a system may already be affected?
Review whether nvm 0.40.5 through 0.40.8 logged a checksum mismatch, then later performed an offline installation of that same Node.js version. Such an installation may have executed the cached archive's `node` and `npm` binaries.
Which version changes the unsafe cache behavior?
Version 0.41.0 caches an archive only after its checksum has passed. This prevents a tarball rejected during checksum verification from remaining available for a later offline installation.