CVE-2026-94185 nvm-sh CVE debrief

Who should care

Developers and administrators who use nvm to manage Node.js versions should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and updating nvm to version 0.40.8 or later, restricting access to nvm to trusted users and repositories, and monitoring nvm usage for suspicious activity.

Why it matters

CVE-2026-94185 is a vulnerability in nvm that allows for the disclosure of arbitrary file contents. Developers and administrators who use nvm should review and update to version 0.40.8 or later, restrict access to nvm, and monitor usage for suspicious activity.

• An attacker may be able to disclose the contents of arbitrary files readable by the user running nvm.
• An attacker may be able to exploit this vulnerability to gain unauthorized access to sensitive information.
• Verification of nvm version and configuration is necessary to determine exposure.
• Remediation requires updating nvm to version 0.40.8 or later.

Technical summary

The vulnerability exists in the nvm_alias() function, which concatenates the requested name onto the $NVM_DIR/alias directory and reads the result with no containment check. This allows an attacker to escape the alias directory and access files outside of it. The vulnerability can be exploited by supplying a specially crafted version string or alias name that traverses the directory structure. An attacker may be able to disclose the contents of arbitrary files readable by the user running nvm. This can lead to unauthorized access to sensitive information.

Defensive priority

Medium

Recommended defensive actions

• Review and update nvm to version 0.40.8 or later
• Restrict access to nvm to trusted users and repositories
• Monitor nvm usage for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was reported in the NVD vulnerability database and is described in CVE-2026-94185. The CVE Program record provides additional metadata on the vulnerability. This issue allows for the disclosure of arbitrary file contents due to a lack of containment checks when resolving version or alias requests in nvm. An attacker can exploit this vulnerability by supplying a specially crafted version string or alias name that traverses the directory structure, allowing access to files outside the intended alias directory. To

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.