CVE-2026-1665 | nvm-sh nvm up to 0.40.3 Environment Variable nvm_download NVM_AUTH_HEADER os command injection

A vulnerability classified as critical has been found in nvm-sh nvm up to 0.40.3. Impacted is the function nvm_download of the component Environment Variable Handler. This manipulation of the argument NVM_AUTH_HEADER causes os command injection.

This vulnerability is tracked as CVE-2026-1665. The attack is restricted to local execution. No exploit exists.

It is recommended to upgrade the affected component.