CVE-2026-104854: Nx Package Vulnerability Allows Local Code Execution via Daemon and Plugin Worker Sockets
Summary
CVE-2026-104854: Nx daemon and plugin worker sockets are accessible to other local users. Affects nx across 2 version ranges.
>= 14.6.0, < 22.7.9
>= 23.0.0, < 23.1.2
Fixed in 22.7.9 or 23.1.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nx is a powerful build framework that helps developers manage and scale their applications efficiently. It provides tools for building, testing, and deploying applications across various platforms. However, a critical vulnerability has been identified in Nx that exposes its daemon and plugin worker sockets to other local users, potentially allowing unauthorized code execution.
Vulnerability Detail
The vulnerability arises from the creation of Unix domain sockets for the Nx daemon and its plugin workers in a shared temporary directory with default permissions. This allows any local user on a multi-user machine to connect to these sockets. The daemon accepts requests that can lead to code execution within the daemon process, enabling one user to execute code as another user running Nx. The lack of authentication and broad filesystem permissions makes this vulnerability particularly severe, especially in shared environments like CI runners and development servers.
How To Fix
Latest published version: 24.0.0 as of 22 Oct 2026
npm install nx@24.0.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 14.6.0, < 22.7.922.7.9npm install nx@22.7.9 -
>= 23.0.0, < 23.1.223.1.2npm install nx@23.1.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you cannot upgrade immediately, you can mitigate the risk by setting the environment variable NX_SOCKET_DIR to a directory you own with permissions set to 0700. Additionally, disable the daemon by setting NX_DAEMON=false. However, note that this does not eliminate the risk from plugin worker sockets.
Conclusion
The Nx package vulnerability CVE-2026-104854 poses a serious risk to multi-user environments by allowing local code execution through improperly secured sockets. It is crucial for users to upgrade to the patched versions or implement workarounds to mitigate potential threats.
See every vulnerability recorded for nx →
FAQ
CVE-2026-104854 is a vulnerability in the Nx package that allows local users to execute code as another user by exploiting the daemon and plugin worker sockets.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json without needing to sign up.
The main risk is that any local user on a shared machine can execute arbitrary code as another user running Nx, potentially leading to unauthorized access and data breaches.
As of now, there is no known evidence of exploitation of this vulnerability in the wild, but it poses a significant risk in shared environments.
The CVSS score of this vulnerability is 8.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for nx.
