chore(deps): update dependency nx to v22.7.7 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
nx (source)	22.7.2 → 22.7.7

---

nx graph dev server permissive CORS policy

CVE-2026-54753 / GHSA-g2r8-wvmj-jf5w

More information

Details

Summary

The local HTTP server started by nx graph sent Access-Control-Allow-Origin: * on every response, letting any website a developer visited read the server's responses cross-origin — including the full project graph and the output of the /help endpoint, which runs a target's configured help command. The practical impact is typically cross-origin information disclosure, but can be arbitrary command injection in rare cases.

Severity

Exploitation requires the developer to be running nx graph and to visit an attacker page. Any execution beyond benign help commands also requires a malicious target to already be present in the workspace (see Details).

Affected & Patched Versions

Package: nx (npm).

• Affected: >= 17.0.4, < 22.7.2 and >= 23.0.0-beta.0, < 23.0.0-beta.2
• Patched: 22.7.2+ (backport) and 23.0.0 (first in 23.0.0-beta.2)

The wildcard CORS header was introduced in 17.0.4; the /help execution endpoint in 19.4.0. The 21.x line is not patched — 21.x users should upgrade to 22.7.2 or later.

Details

nx graph starts a local server (default http://127.0.0.1:4211). Before the fix, its request handler set a wildcard CORS header on every response:

res.setHeader('Access-Control-Allow-Origin', '*');

The /help endpoint runs a target's configured command:

const command = target.metadata?.help?.command;
return execSync(command, { cwd: target.options?.cwd ?? workspaceRoot }).toString();

A GET /help is a CORS "simple request", so a malicious page could fetch() it with no preflight, and the wildcard header let the page read the result. This exposes the project graph (project names, file paths, dependencies, build configuration) and the output of any configured help command.

The command is not attacker-controlled through the request — it comes from the workspace's project configuration, and first-party plugins (jest, vite, cypress) populate it with benign, read-only help commands. For /help to run anything malicious, a target carrying a malicious help.command must already exist in the project graph, which can only be introduced by installing a malicious package or by altering the workspace's own code/configuration — both of which already grant code execution independent of this flaw.

The fix (#​35494) removes the header; the browser's same-origin policy then blocks cross-origin reads.

References

• Fix: nrwl/nx#35494
• Introduced: nrwl/nx#20744 (CORS), nrwl/nx#26629 (/help)

Credits

Thanks to Nozomu Sasaki (Paul) (@​morimori-dev) for finding and responsibly reporting this issue.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

References

• https://github.com/nrwl/nx/security/advisories/GHSA-g2r8-wvmj-jf5w
• https://nvd.nist.gov/vuln/detail/CVE-2026-54753
• https://github.com/nrwl/nx/pull/35494
• https://github.com/nrwl/nx/commit/7620c1ffe598086ce5e66457c7e6e38799bb499d
• https://github.com/nrwl/nx/commit/e59122c5569cf201561b9995ce4e34a304f4fb03
• https://github.com/nrwl/nx/releases/tag/22.7.2
• https://github.com/advisories/GHSA-g2r8-wvmj-jf5w

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Nx: Zip-Slip in the self-hosted remote cache

CVE-2026-71476 / GHSA-vp3h-ghgh-jr7g

More information

Details

Summary

The Nx self-hosted HTTP remote cache extracts downloaded cache artifacts without constraining where files are written. A malicious — or on-path (MITM) — remote cache server can return a crafted tar archive whose entries escape the cache directory and write to arbitrary locations on the machine running Nx. This arbitrary file write can be escalated to remote code execution. The directly exploitable issue is the self-hosted HTTP remote cache.

Affected Packages

[!IMPORTANT]
Nx's default local cache and Nx Cloud are NOT affected. The default local cache and Nx Cloud use separate cache retrieval and extraction mechanisms that does not have this vulnerability. Only workspaces that use a self-hosted remote cache (NX_SELF_HOSTED_REMOTE_CACHE_SERVER, @nx/s3-cache, etc.) are affected.

Two self-hosted cache surfaces are affected:

1. The built-in HTTP remote cache (NX_SELF_HOSTED_REMOTE_CACHE_SERVER, in nx) — fixed in the patched release.
2. The self-hosted cache packages — @nx/s3-cache, @nx/gcs-cache, @nx/azure-cache, @nx/shared-fs-cache (and their @nx/powerpack-* predecessors) — the same flaw in their own extractor. Deprecated (CVE-2025-36852) and not patched; migrate off (see Remediation).

The shared step that copies cached outputs into the workspace was also part of the exposure and is hardened in the patched nx release.

Remediation

Upgrade to Nx 22.7.7 or 23.0.2 (or later). The patched extractor is a drop-in — no configuration change is required.

If you use the S3, GCS, Azure, or shared-filesystem cache packages

@nx/s3-cache, @nx/gcs-cache, @nx/azure-cache, and @nx/shared-fs-cache (and their @nx/powerpack-* predecessors) are separately versioned packages and are already deprecated (see CVE-2025-36852). Upgrading nx hardens the shared restore step, but it does not fully secure these packages. The remediation for them is to migrate off — to Nx Cloud or the self-hosted OpenAPI/HTTP remote cache — per the deprecation guidance: https://nx.dev/docs/reference/deprecated/self-hosted-cache-packages

Details

When Nx retrieves an artifact from the self-hosted HTTP remote cache, it downloads a gzipped tar archive and extracts it. The extractor joined each untrusted tar entry name directly onto the output directory and unpacked it with tar's unguarded Entry::unpack(), which performs no containment check:

// vulnerable
let path_on_disk = output_dir.join(entry_path); // entry_path is attacker-controlled
fs::create_dir_all(path_on_disk.parent()…)?;
entry.unpack(&path_on_disk)?;

In addition, restore now copies only the declared task outputs (never the whole cache directory), confined to the workspace root; parent directories are realized as real directories so a write can never traverse a symlink; declared outputs that resolve outside the workspace are rejected; and the malformed-input cases return errors instead of panicking.

References

• Fix: https://github.com/nrwl/nx/pull/36116 (merged)
• TLS-verification warning follow-up: https://github.com/nrwl/nx/pull/36132 (merged)
• Vulnerable extractor introduced in Nx 20.8.0: https://github.com/nrwl/nx/pull/30593

Credits

• Lidor B., Novee Security — Reporter
• Assaf Levkovich, Novee Security — Reporter

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/nrwl/nx/security/advisories/GHSA-vp3h-ghgh-jr7g
• https://github.com/nrwl/nx/pull/36116
• https://github.com/nrwl/nx/commit/2b20c2da39d263c32ae05767577589481a309fee
• https://github.com/nrwl/nx/commit/a82807621e4176e37909d2c1afede661b45cc30
• https://github.com/nrwl/nx/commit/ad296578fe980a4aad66f8af0add21f6ddf907d9
• https://github.com/advisories/GHSA-vp3h-ghgh-jr7g

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

nrwl/nx (nx)

v22.7.7

Compare Source

22.7.7 (2026-07-10)

🩹 Fixes

• core: prevent path traversal / zip-slip in self-hosted remote cache (#​36116)
• core: warn when the self-hosted remote cache disables TLS verification (NXC-4593) (#​36132, #​36116)
• dotnet: declare obj as a publish output to fix sandbox violation (#​35858)
• dotnet: declare directory build props input for analyzer dotnet tasks (df7540195a)
• dotnet: declare directory build props on the separate release build target (6545ee2222)
• dotnet: declare directory build props on the analyzer tests dotnet targets (e72ee0dd79)

❤️ Thank You

• FrozenPandaz @​FrozenPandaz
• Jason Jean @​FrozenPandaz

v22.7.6

Compare Source

22.7.6 (2026-06-23)

🩹 Fixes

• misc: bump happy-dom, tmp, and form-data to patched versions (#​36013)

❤️ Thank You

• Jack Hsu @​jaysoo

v22.7.5

Compare Source

22.7.5 (2026-05-27)

🩹 Fixes

• core: update tmp to 0.2.6 due to CVE-2026-44705 (#​35813)

❤️ Thank You

• Jack Hsu @​jaysoo

v22.7.4

Compare Source

22.7.4 (2026-05-25)

🩹 Fixes

• core: update brace-expansion and yaml (#​35790)

❤️ Thank You

• Jack Hsu @​jaysoo

v22.7.3

Compare Source

22.7.3 (2026-05-22)

🚀 Features

• js: support pnpm 11.2.2 (#​35772)

🩹 Fixes

• angular: only add @​oxc-project/runtime on the vitest-analog path (#​35734)
• angular-rspack: exclude eslint config from tailwind v4 source scan (#​35663)
• core: warn before installing unknown npm packages as preset (#​35644)
• core: preserve input order in createNodes plugin results (#​35595)
• core: resolve local plugin subpath imports from source (#​35631)
• core: treat undefined task parallelism as parallel when scheduling (#​35736)
• core: handle object form of bin field in getPrettierPath (#​35680)
• core: detect vscode copilot ai agent (#​35757)
• core: allow local plugin subpath imports without custom conditions (#​35751, #​35631)
• dotnet: include Directory.. files in inputs (#​35738)
• gradle: add transitive:true to all tasks (#​35677)
• gradle: pin generated e2e project toolchain to installed JDK (#​35703)
• js: fall back to npm publish when bun publish fails with auth error (#​35756)
• linter: improve convert-to-flat-config output fidelity (#​35330)
• linter: only rewrite workspace-package peer deps to workspace:* (#​35423, #​35318, #​33417)
• misc: stop inferring projects: 'self' in dependsOn entries (#​35686)
• misc: skip $ escaping in file paths on windows (#​35692)
• repo: run dotnet restore before publish (#​35771)
• repo: run dotnet restore before macos e2e job (#​35774)
• rsbuild: infer build outputs from distPath.root directly (#​35707)
• rsbuild: lazy-require @​rsbuild/core in plugin so spec mocks work after jest.resetModules (#​35707)
• testing: correct yargs-parser import in getJestProjectsAsync (#​35672, #​35654)

❤️ Thank You

• AgentEnder @​AgentEnder
• Artur @​arturovt
• Benjamin Staneck @​Stanzilla
• Copilot @​Copilot
• Craigory Coppola @​AgentEnder
• FrozenPandaz @​FrozenPandaz
• Jason Jean @​FrozenPandaz
• Leosvel Pérez Espinosa @​leosvelperez
• leosvelperez @​leosvelperez
• Louie Weng @​lourw

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.