CVE-2026-15921: Node Version Manager Path Traversal Flaw

CVE-2026-15921 Overview

CVE-2026-15921 is a path traversal vulnerability [CWE-22] in Node Version Manager (nvm), a POSIX-compliant shell function for managing multiple Node.js versions. Versions 0.32.1 through 0.40.5 fail to validate the LTS codename field returned by the Node.js mirror's index.tab before using it as an alias filename. A malicious or man-in-the-middled mirror can inject path traversal sequences such as ../../../.bashrc into that field. When a user runs nvm ls-remote or nvm install --lts, nvm writes version strings to attacker-controlled paths, potentially overwriting shell startup files and enabling code execution in later shell sessions.

Critical Impact
A hostile Node.js mirror can overwrite files in the user's home directory, including .bashrc and other shell initialization files, leading to code execution in subsequent shell sessions.

Affected Products

nvm (Node Version Manager) versions 0.32.1 through 0.40.5
Systems using nvm with a compromised or man-in-the-middled Node.js mirror
Environments where NVM_NODEJS_ORG_MIRROR or NVM_IOJS_ORG_MIRROR are set to untrusted values

Discovery Timeline

2026-07-15 - CVE-2026-15921 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-15921

Vulnerability Analysis

The flaw resides in how nvm processes remote LTS (Long-Term Support) metadata. When commands such as nvm ls-remote or nvm install --lts refresh remote LTS aliases, nvm fetches the mirror's index.tab file and treats each release's LTS codename field as an alias filename. The codename is written to a file under $NVM_DIR/alias, but the value undergoes no path component validation. This allows a mirror to supply a codename containing .. segments that escape the alias directory.

With the default installation layout, $NVM_DIR resolves to ~/.nvm, meaning writes can reach anywhere under the user's home directory. Files targeted at shell startup scripts like .bashrc, .zshrc, or .profile execute their contents at the next interactive shell launch, converting an alias write into arbitrary command execution under the user's account.

Root Cause

The root cause is missing input validation on data sourced from a network-controlled input. The nvm_add_alias function accepts an alias name derived from the mirror's index.tab without checking for .. path components. Slashes are legitimate within alias names (for example, lts/iron), so the parser was permissive by design. However, no defensive check rejected traversal sequences before file creation.

Attack Vector

Exploitation requires the victim to fetch metadata from a hostile mirror. This can occur through a compromised upstream mirror or content delivery network, an active network man-in-the-middle, or a maliciously configured NVM_NODEJS_ORG_MIRROR or NVM_IOJS_ORG_MIRROR environment variable. The victim must then execute an affected command such as nvm ls-remote or nvm install --lts. User interaction is required, but no authentication or elevated privileges are needed on the target.

bash

     nvm_err "an alias target version is required"
     return 2
   fi
+  # slashes are legal (eg `lts/iron`), but a `..` component would escape the alias dir
+  case "/${ALIAS}/" in
+    */../*)
+      nvm_err "invalid alias name: ${ALIAS}"
+      return 3
+    ;;
+  esac
   nvm_echo "${VERSION}" | tee "$(nvm_alias_path)/${ALIAS}" >/dev/null
 }

Source: nvm-sh/nvm patch commit 9275c5b. The patch adds a case statement that explicitly rejects any alias name containing a .. path component before the tee write.

Detection Methods for CVE-2026-15921

Indicators of Compromise

Unexpected files under $NVM_DIR/alias/ containing .. characters or unusual paths
Modification of shell startup files (.bashrc, .zshrc, .profile, .bash_profile) with timestamps aligned to nvm command execution
NVM_NODEJS_ORG_MIRROR or NVM_IOJS_ORG_MIRROR environment variables pointing to unofficial hosts
HTTP (rather than HTTPS) traffic to Node.js mirror endpoints from developer workstations

Detection Strategies

Audit user home directories for shell startup file modifications following recent nvm ls-remote or nvm install --lts executions
Inspect shell command history for nvm invocations paired with non-default mirror environment variables
Compare installed nvm version against 0.40.6 on developer endpoints and CI runners
Review index.tab responses in proxy or endpoint telemetry for LTS codename fields containing .. or slashes preceding ..

Monitoring Recommendations

Alert on writes to shell startup files performed by shell processes invoking nvm functions
Monitor outbound connections to Node.js mirror domains and flag deviations from nodejs.org or approved CDN endpoints
Track process creation chains where interactive shells spawn unexpected child processes shortly after login

How to Mitigate CVE-2026-15921

Immediate Actions Required

Upgrade nvm to version 0.40.6 or later on all developer workstations, build servers, and CI/CD runners
Unset or verify NVM_NODEJS_ORG_MIRROR and NVM_IOJS_ORG_MIRROR to ensure they reference only trusted, HTTPS-enabled endpoints
Inspect $NVM_DIR/alias/ for suspicious filenames and audit shell startup files for unauthorized modifications
Rotate credentials or tokens sourced from affected user accounts if shell startup file tampering is confirmed

Patch Information

Version 0.40.6 validates remote LTS codenames as safe alias filenames and rejects .. path components when writing alias files. Reference the GitHub Security Advisory GHSA-4ghp-wxpw-rhpg and the patch commit for full remediation details.

Workarounds

Avoid running nvm ls-remote and nvm install --lts until the upgrade to 0.40.6 is applied
Enforce HTTPS-only access to nodejs.org mirrors and block plaintext HTTP egress from developer subnets
Remove any custom NVM_NODEJS_ORG_MIRROR or NVM_IOJS_ORG_MIRROR overrides from shell profiles unless the mirror is fully trusted