Skip to main content
cve.nowby Sazabi
← npm
npmPackage

nx

4 known vulnerabilities (2 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 2 high, 2 medium
Weekly downloads
14.7M
Dependents
95
Registry
npm

Advisories 4

  • Nx daemon and plugin worker sockets are accessible to other local users

    Affected: from 14.6.0, fixed in 22.7.9; from 23.0.0, fixed in 23.1.2.

  • CVE-2026-104853Medium 5.8

    Nx: Path traversal in nx migrate package-migrations extraction

    Affected: from 13.10.0, fixed in 22.7.10; from 23.0.0, fixed in 23.2.1.

  • Nx: Zip-Slip in the self-hosted remote cache

    Affected: from 20.8.0, fixed in 22.7.7; from 23.0.0, fixed in 23.0.2.

  • CVE-2026-54753Medium 5.9

    Nx: `nx graph` dev server permissive CORS policy

    Affected: from 17.0.4, fixed in 22.7.2; from 23.0.0-beta.0, fixed in 23.0.0-beta.2.