CVE-2026-71476

Path Traversal in nx (CVE-2026-71476)

Summary

Path traversal in nx (CVE-2026-71476). Risk of unauthorized operations or information disclosure. Exploitable via NX_SELF_HOSTED_REMOTE_CACHE_SERVER. Mitigation: upgrade to 23.0.2 or later.

Original description

The description as published by the source.

Summary

The Nx self-hosted HTTP remote cache extracts downloaded cache artifacts without constraining where files are written. A malicious — or on-path (MITM) — remote cache server can return a crafted tar archive whose entries escape the cache directory and write to arbitrary locations on the machine running Nx. This arbitrary file write can be escalated to remote code execution. The directly exploitable issue is the self-hosted HTTP remote cache.

Affected Packages

[!IMPORTANT]
Nx's default local cache and Nx Cloud are NOT affected. The default local cache and Nx Cloud use separate cache retrieval and extraction mechanisms that does not have this vulnerability. Only workspaces that use a self-hosted remote cache (NX_SELF_HOSTED_REMOTE_CACHE_SERVER, @nx/s3-cache, etc.) are affected.

Two self-hosted cache surfaces are affected:

The built-in HTTP remote cache (NX_SELF_HOSTED_REMOTE_CACHE_SERVER, in nx) — fixed in the patched release.
The self-hosted cache packages — @nx/s3-cache, @nx/gcs-cache, @nx/azure-cache, @nx/shared-fs-cache (and their @nx/powerpack-* predecessors) — the same flaw in their own extractor. Deprecated (CVE-2025-36852) and not patched; migrate off (see Remediation).

The shared step that copies cached outputs into the workspace was also part of the exposure and is hardened in the patched nx release.

Remediation

Upgrade to Nx 22.7.7 or 23.0.2 (or later). The patched extractor is a dr…

Source: GitHub Security Advisories (Global) NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2026-71476 has been found in nx.
Attackers can target a specific entry point like NX_SELF_HOSTED_REMOTE_CACHE_SERVER over the network to misuse the product.
Risk of unauthorized operations or information disclosure.
What to do: upgrade nx to 23.0.2 or later.
If unsure, ask your IT team or search "nx CVE-2026-71476" on the vendor's site.

CVE-2026-71476 (nx) — CWE-22
Attack surface: NX_SELF_HOSTED_REMOTE_CACHE_SERVER / tar
Patched: 23.0.2 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

Path traversal (CWE-22) exists in nx. Attackers reach the vulnerable code path via NX_SELF_HOSTED_REMOTE_CACHE_SERVER.

📍 Affected scope

Check the vendor advisory for the affected versions of nx. Attack surface: NX_SELF_HOSTED_REMOTE_CACHE_SERVER / tar.

🔥 Severity

Severity: ?. Risk of unauthorized operations or information disclosure.

🔧 How to fix

Update to 23.0.2.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'nx' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
grep -r 'nx' . | grep -v node_modules
```
リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で nx を grep し、稼働しているサービス・バージョンを把握する。
2
Apply patch patch
```
Upgrade nx to 23.0.2
```
ステージング環境で 23.0.2 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
3
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。