CVE-2026-121745: nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command line

Is it exploited?

Not on CISA's list. CISA has not added it to the Known Exploited Vulnerabilities catalog as of 10 Nov 2026. If CISA adds it, this page shows it as known exploited.

How likely is exploitation in the next 30 days?

0.1%

EPSS score, percentile 2 of all scored records. A probability estimated by FIRST, not a report of exploitation.

How severe?

2.0 Low

CVSS v4.0 base score, given by the CNA

What should I do?

Upgrade to nvm 0.41.0 or later, and on a machine shared with other local users make sure curl or GNU Wget is installed (BusyBox wget still receives the header as an … Full textSolution from the CVE record.

CISA has set no required action, because the vulnerability is not in KEV.

Advisories and patches (2)

Which versions are affected?

Affected

• from 0.40.0 to before 0.41.0

Versions by product

Source: CISA KEV 2026.11.10, as of 10 Nov 2026; FIRST EPSS, as of 12 Nov 2026; CVE List, as of 12 Nov 2026. About the data.

Description

nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command line

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when `NVM_AUTH_HEADER` is set, `nvm_download` passes the credential to curl or wget as a `--header "Authorization: ..."` command-line argument. Process arguments are visible to every local user (on Linux via `ps` or `/proc//cmdline` unless `/proc` is mounted with `hidepid=`; on macOS via `ps`), so another unprivileged account on the same machine can read the token while nvm is downloading during `nvm ls-remote`, `nvm install`, and similar commands, and gain whatever access it grants on the private mirror. Only users who set `NVM_AUTH_HEADER` on a host shared with other local accounts are affected. Version 0.41.0 passes the header to curl on stdin and to GNU Wget in a private temporary config file. BusyBox wget reads no config file, so when it is the only downloader available the header is still passed as an argument.

Source: CVE List, as of 12 Nov 2026. About the data.

What to do

Advisories and patches

• Fix commit 903e3493 (Patch)
• GHSA-h3c2-g6gc-6cgx (Vendor advisory)

Solution (from the CVE record)

Upgrade to nvm 0.41.0 or later, and on a machine shared with other local users make sure curl or GNU Wget is installed (BusyBox wget still receives the header as an argument).

Workaround (from the CVE record)

Until upgrading, do not set `NVM_AUTH_HEADER` on machines shared with other local users, or mount `/proc` with `hidepid=2` on Linux.

This summary is based on the CVE record as of 12 Nov 2026. Check the vendor's advisory before you act: affected versions and fixes can change.

Affected products and versions

Source: CVE List, as of 12 Nov 2026. About the data.

Timeline