CVE-2026-71476

A flaw was found in Nx. The self-hosted HTTP remote cache component improperly extracts downloaded cache artifacts, allowing files to be written outside the intended directory. A malicious or on-path (Man-in-the-Middle) remote cache server can exploit this Zip-Slip vulnerability by providing a specially crafted archive. This can lead to arbitrary file writes and potential remote code execution on the machine running Nx, affecting only workspaces configured to use a self-hosted remote cache.

A flaw was found in Nx where the self-hosted HTTP remote cache extracts downloaded cache artifacts without validating file paths, allowing a Zip-Slip path traversal attack. Red Hat products that bundle Nx use it as a build tool and do not use the self-hosted remote cache feature, limiting the exploitability of this vulnerability in Red Hat environments. The AAP 2.6 and 2.7 gateway container images bundle a vulnerable version of Nx and are being evaluated for impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.