---
id: "CVE-2026-121745"
kind: "vulnerability"
aliases: ["CVE-2026-121745"]
title: "nvm: download auth token visible in process list to local users"
severity: "low"
cvss: 2.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["node.js", "nvm", "package", "private-mirror", "shared-hosts"]
not_affected_if: ["hidepid-set", "no-nvm_auth_header", "single-user-machine", "version-0.41.0-or-later"]
published_at: "2026-11-04T22:17:53+00:00"
first_seen_at: "2026-11-04T23:08:47+00:00"
updated_at: "2026-11-04T23:10:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121745", "first_seen_at": "2026-11-04T23:08:47+00:00"}]
exploit_sources: []
---

# nvm: download auth token visible in process list to local users

nvm 0.40.0 through 0.40.8 passes the NVM_AUTH_HEADER credential to curl or wget as a command-line argument during downloads. Any other local user on the same machine can read the token from the process list and use it to reach the private mirror it grants access to.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `nvm --version` to see whether the installed version is between `0.40.0` and `0.40.8`
- Check whether `NVM_AUTH_HEADER` is set in shell profiles or the environment of users on a shared host
- Note whether `/proc` is mounted with `hidepid=` on Linux, since that limits who can read process arguments

## Timeline

- 2026-11-04T23:08:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121745

## Documents

- [advisory] Vendor advisory: github.com https://github.com/nvm-sh/nvm/security/advisories/GHSA-h3c2-g6gc-6cgx
- [fix] Patch: github.com https://github.com/nvm-sh/nvm/commit/903e3493699399d049f3af445c2d81688b6a7f5c

## From the sources

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when `NVM_AUTH_HEADER` is set, `nvm_download` passes the credential to curl or wget as a `--header "Authorization: ..."` command-line argument. Process arguments are visible to every local user (on Linux via `ps` or `/proc//cmdline` unless `/proc` is mounted with `hidepid=`; on macOS via `ps`), so another unprivileged account on the same machine can read the token while nvm is downloading during `nvm ls-remote`, `nvm install`, and similar commands, and gain whatever access it grants on the private mirror. Only users who set `NVM_AUTH_HEADER` on a host shared with other local accounts are affected. Version 0.41.0 passes the header to curl on stdin and to GNU Wget in a private temporary config file. BusyBox wget reads no config file, so when it is the only downloader available the header is still passed as an argument.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_