CVE Tools
Track your stack

NX

15 CVEs tracked. 2 of them are in CISA KEV.

This hub aggregates every CVE we track for NX, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

NX CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
NX CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-091
2025-100
2025-110
2025-120
2026-010
2026-021
2026-030
2026-040
2026-050
2026-061
2026-070
2026-081
2026-090
2026-105

Severity

How the 15 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical333%
  • High444%
  • Medium222%

Latest CVEs

The 15 most recently published vulnerabilities affecting NX.

  1. CVE-2026-119282Nx: OS command injection via nx.json plugin options in @nx/maven and @nx/gradle—
  2. GHSA-w2vw-w76x-qr89Nx: OS command injection via git revisions and remote refs—
  3. CVE-2026-104859Nx: OS command injection in the @nx/docker release pipeline—
  4. CVE-2026-104854Nx daemon and plugin worker sockets are accessible to other local users—
  5. CVE-2026-104853Nx: Path traversal in nx migrate package-migrations extraction—
  6. CVE-2026-71476Nx: Zip-Slip in the self-hosted remote cache—
  7. CVE-2026-54753Nx: `nx graph` dev server permissive CORS policy5.9
  8. CVE-2026-22923A vulnerability has been identified in NX (All versions < V2512), NX (Managed Mode) (All versions < V2512). The affected application contains a data validation vulnerability that could allow an att...7.8
  9. CVE-2025-10894Nx: nx/devkit: malicious versions of nx and plugins published to npm9.6
  10. CVE-2024-41908A vulnerability has been identified in NX (All versions < V2406.3000). The affected applications contains an out of bounds read vulnerability while parsing specially crafted PRT files. This could a...7.8
  11. CVE-2023-31178AgilePoint NX v8.0 SU2.2 & SU2.3 – Arbitrary File Delete8.1
  12. CVE-2023-31179AgilePoint NX v8.0 SU2.2 & SU2.3 - Path traversal6.5
  13. CVE-2023-24507AgilePoint NX v8.0 SU2.2 & SU2.3 – Insecure File Upload8.8
  14. CVE-2021-45046Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack9.0
  15. CVE-2021-44228Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints10.0

Product grouping is registry-driven, with AI assist and human review. How it works