PT-2026-137187

Name of the Vulnerable Software and Affected Versions Node Version Manager nvm versions 0.40.0 through 0.40.8 Description When the NVM AUTH HEADER variable is set, the nvm download function passes credentials to curl or wget as a command-line argument. Because process arguments are visible to all...

PT-2026-137192

Name of the Vulnerable Software and Affected Versions Node Version Manager nvm versions 0.40.5 through 0.40.8 Description The nvm download artifact function downloads a release archive to $NVM DIR/.cache and verifies the checksum after the download is complete. If a checksum mismatch occurs, the...

Node Version Manager security vulnerability

Node Version Manager is an open-source node version manager developed by nvm.sh. Versions of Node Version Manager prior to 0.40.3 contain security vulnerabilities. These vulnerabilities stem from the nvmdownload function using eval to execute the wget command, and the NVMAUTHHEADER environment...