CVE-2026-121745

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when NVM_AUTH_HEADER is set, nvm_download passes the credential to curl or wget as a --header "Authorization: ..." command-line argument. Process arguments are visible to every local user (on Linux via ps or /proc//cmdline unless /proc is mounted with hidepid=; on macOS via ps), so another unprivileged account on the same machine can read the token while nvm is downloading during nvm ls-remote, nvm install, and similar commands, and gain whatever access it grants on the private mirror. Only users who set NVM_AUTH_HEADER on a host shared with other local accounts are affected. Version 0.41.0 passes the header to curl on stdin and to GNU Wget in a private temporary config file. BusyBox wget reads no config file, so when it is the only downloader available the header is still passed as an argument.

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when NVM_AUTH_HEADER is set, nvm_download passes the credential to curl or wget as a --header "Authorization: ..." command-line argument. Process arguments are visible to every local user (on Linux via ps or /proc//cmdline unless /proc is mounted with hidepid=; on macOS via ps), so another unprivileged account on the same machine can read the token while nvm is downloading during nvm ls-remote, nvm install, and similar commands, and gain whatever access it grants on the private mirror. Only users who set NVM_AUTH_HEADER on a host shared with other local accounts are affected. Version 0.41.0 passes the header to curl on stdin and to GNU Wget in a private temporary config file. BusyBox wget reads no config file, so when it is the only downloader available the header is still passed as an argument.

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when NVM_AUTH_HEADER is set, nvm_download passes the credential to curl or wget as a --header "Authorization: ..." command-line argument. Process arguments are visible to every local user (on Linux via ps or /proc//cmdline unless /proc is mounted with hidepid=; on macOS via ps), so another unprivileged account on the same machine can read the token while nvm is downloading during nvm ls-remote, nvm install, and similar commands, and gain whatever access it grants on the private mirror. Only users who set NVM_AUTH_HEADER on a host shared with other local accounts are affected. Version 0.41.0 passes the header to curl on stdin and to GNU Wget in a private temporary config file. BusyBox wget reads no config file, so when it is the only downloader available the header is still passed as an argument.

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when NVM_AUTH_HEADER is set, nvm_download passes the credential to curl or wget as a --header "Authorization: ..." command-line argument. Process arguments are visible to every local user (on Linux via ps or /proc//cmdline unless /proc is mounted with hidepid=; on macOS via ps), so another unprivileged account on the same machine can read the token while nvm is downloading during nvm ls-remote, nvm install, and similar commands, and gain whatever access it grants on the private mirror. Only users who set NVM_AUTH_HEADER on a host shared with other local accounts are affected. Version 0.41.0 passes the header to curl on stdin and to GNU Wget in a private temporary config file. BusyBox wget reads no config file, so when it is the only downloader available the header is still passed as an argument.