CVE-2026-71476 is a path traversal vulnerability in Nx's self-hosted remote cache implementation, affecting versions 20.8.0 through 22.7.7 and 23.0.2. When Nx restores cached build artifacts from a self-hosted cache server, it extracts tar archives without sanitizing path components — a vulnerability with the same root cause as the well-documented Zip Slip family. Local cache and Nx Cloud implementations are unaffected because they have response authenticity checks; self-hosted does not.
The CVE classification as "conditional" based on MITM positioning dramatically understates the real risk in CI/CD environments. Self-hosted Nx caches are overwhelmingly deployed in pipelines where runners share network infrastructure — internal Kubernetes pod networks, layer-2 segments with ARP spoofing exposure, or compromised runner agents. In these contexts, on-path positioning is realistic, not theoretical. But the deeper problem isn't network positioning at all: a compromised or malicious cache server doesn't need to intercept traffic — it is the trusted endpoint. Nx accepts cache artifacts without verifying that the bytes actually came from a legitimate build, because the self-hosted cache is treated as a configuration parity option rather than a security boundary.
The blast radius is severe. A single poisoned cache entry propagates across all subsequent pipeline runs and branches that restore from that cache key — across thousands of builds and potentially multiple repositories if a single cache server serves multiple workspaces. Unlike a typical vulnerability, patching Nx doesn't close the exposure: contaminated cache entries persist until explicitly purged, and most organizations have no mechanism to enumerate which cache keys were written under vulnerable versions.
What to check: Verify whether your Nx workspace uses a self-hosted remote cache (look for nx.json or environment variables pointing to an internal server rather than nx.app). If self-hosted, confirm whether the cache server implements artifact signing or HMAC verification — it almost certainly doesn't.
Prioritized actions: (1) Audit all self-hosted cache server configurations and treat them as equivalent to runner compromise in your threat model. (2) Implement mutual TLS with certificate pinning between runners and cache servers to raise the MITM bar in shared-infrastructure environments. (3) The more durable fix is artifact signing — Nx should verify cache responses cryptographically before extraction, and defenders should push for this capability in their Nx deployments. (4) Expire and repopulate the cache after patching to clear any contaminated artifacts written under affected versions. (5) Audit other archive-handling code paths in your toolchain — Zip Slip variants keep recurring because teams fix the reported instance without auditing siblings that use the same extraction logic.