CVE-2026-121745

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when NVM_AUTH_HEADER is set, nvm_download passes the credential to curl or wget as a --header "Authorization: ..." command-line argument. Process arguments are visible to every local user (on Linux via ps or /proc//cmdline unless /proc is mounted with hidepid=; on macOS via ps), so another unprivileged account on the same machine can read the token while nvm is downloading during nvm ls-remote, nvm install, and similar commands, and gain whatever access it grants on the private mirror. Only users who set NVM_AUTH_HEADER on a host shared with other local accounts are affected. Version 0.41.0 passes the header to curl on stdin and to GNU Wget in a private temporary config file. BusyBox wget reads no config file, so when it is the only downloader available the header is still passed as an argument.