chore(deps): update dependency nx to v22.7.7 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
nx (source)	22.7.5 → 22.7.7

---

Nx: Zip-Slip in the self-hosted remote cache

CVE-2026-71476 / GHSA-vp3h-ghgh-jr7g

More information

Details

Summary

The Nx self-hosted HTTP remote cache extracts downloaded cache artifacts without constraining where files are written. A malicious — or on-path (MITM) — remote cache server can return a crafted tar archive whose entries escape the cache directory and write to arbitrary locations on the machine running Nx. This arbitrary file write can be escalated to remote code execution. The directly exploitable issue is the self-hosted HTTP remote cache.

Affected Packages

[!IMPORTANT]
Nx's default local cache and Nx Cloud are NOT affected. The default local cache and Nx Cloud use separate cache retrieval and extraction mechanisms that does not have this vulnerability. Only workspaces that use a self-hosted remote cache (NX_SELF_HOSTED_REMOTE_CACHE_SERVER, @nx/s3-cache, etc.) are affected.

Two self-hosted cache surfaces are affected:

1. The built-in HTTP remote cache (NX_SELF_HOSTED_REMOTE_CACHE_SERVER, in nx) — fixed in the patched release.
2. The self-hosted cache packages — @nx/s3-cache, @nx/gcs-cache, @nx/azure-cache, @nx/shared-fs-cache (and their @nx/powerpack-* predecessors) — the same flaw in their own extractor. Deprecated (CVE-2025-36852) and not patched; migrate off (see Remediation).

The shared step that copies cached outputs into the workspace was also part of the exposure and is hardened in the patched nx release.

Remediation

Upgrade to Nx 22.7.7 or 23.0.2 (or later). The patched extractor is a drop-in — no configuration change is required.

If you use the S3, GCS, Azure, or shared-filesystem cache packages

@nx/s3-cache, @nx/gcs-cache, @nx/azure-cache, and @nx/shared-fs-cache (and their @nx/powerpack-* predecessors) are separately versioned packages and are already deprecated (see CVE-2025-36852). Upgrading nx hardens the shared restore step, but it does not fully secure these packages. The remediation for them is to migrate off — to Nx Cloud or the self-hosted OpenAPI/HTTP remote cache — per the deprecation guidance: https://nx.dev/docs/reference/deprecated/self-hosted-cache-packages

Details

When Nx retrieves an artifact from the self-hosted HTTP remote cache, it downloads a gzipped tar archive and extracts it. The extractor joined each untrusted tar entry name directly onto the output directory and unpacked it with tar's unguarded Entry::unpack(), which performs no containment check:

// vulnerable
let path_on_disk = output_dir.join(entry_path); // entry_path is attacker-controlled
fs::create_dir_all(path_on_disk.parent()…)?;
entry.unpack(&path_on_disk)?;

In addition, restore now copies only the declared task outputs (never the whole cache directory), confined to the workspace root; parent directories are realized as real directories so a write can never traverse a symlink; declared outputs that resolve outside the workspace are rejected; and the malformed-input cases return errors instead of panicking.

References

• Fix: https://github.com/nrwl/nx/pull/36116 (merged)
• TLS-verification warning follow-up: https://github.com/nrwl/nx/pull/36132 (merged)
• Vulnerable extractor introduced in Nx 20.8.0: https://github.com/nrwl/nx/pull/30593

Credits

• Lidor B., Novee Security — Reporter
• Assaf Levkovich, Novee Security — Reporter

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/nrwl/nx/security/advisories/GHSA-vp3h-ghgh-jr7g
• https://github.com/nrwl/nx/pull/36116
• https://github.com/nrwl/nx/commit/2b20c2da39d263c32ae05767577589481a309fee
• https://github.com/nrwl/nx/commit/a82807621e4176e37909d2c1afede661b45cc30
• https://github.com/nrwl/nx/commit/ad296578fe980a4aad66f8af0add21f6ddf907d9
• https://github.com/advisories/GHSA-vp3h-ghgh-jr7g

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

nrwl/nx (nx)

v22.7.7

Compare Source

22.7.7 (2026-07-10)

🩹 Fixes

• core: prevent path traversal / zip-slip in self-hosted remote cache (#​36116)
• core: warn when the self-hosted remote cache disables TLS verification (NXC-4593) (#​36132, #​36116)
• dotnet: declare obj as a publish output to fix sandbox violation (#​35858)
• dotnet: declare directory build props input for analyzer dotnet tasks (df7540195a)
• dotnet: declare directory build props on the separate release build target (6545ee2222)
• dotnet: declare directory build props on the analyzer tests dotnet targets (e72ee0dd79)

❤️ Thank You

• FrozenPandaz @​FrozenPandaz
• Jason Jean @​FrozenPandaz

v22.7.6

Compare Source

22.7.6 (2026-06-23)

🩹 Fixes

• misc: bump happy-dom, tmp, and form-data to patched versions (#​36013)

❤️ Thank You

• Jack Hsu @​jaysoo

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[nx-cloud]

View your CI Pipeline Execution ↗ for commit ea9b1ad

Command	Status	Duration	Result
nx run-many --target=test --all --configuration...	✅ Succeeded	1s	View ↗
nx run-many --target=lint --all --exclude=creat...	✅ Succeeded	<1s	View ↗
nx lint-types store	✅ Succeeded	<1s	View ↗
nx run-many --target=build --all	✅ Succeeded	<1s	View ↗

💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗

---

☁️ Nx Cloud last updated this comment at 2026-08-29 14:19:52 UTC

[pkg-pr-new]

Open in StackBlitz

@ngxs/devtools-plugin

npm i https://pkg.pr.new/@ngxs/devtools-plugin@2485

@ngxs/form-plugin

npm i https://pkg.pr.new/@ngxs/form-plugin@2485

@ngxs/hmr-plugin

npm i https://pkg.pr.new/@ngxs/hmr-plugin@2485

@ngxs/router-plugin

npm i https://pkg.pr.new/@ngxs/router-plugin@2485

@ngxs/storage-plugin

npm i https://pkg.pr.new/@ngxs/storage-plugin@2485

@ngxs/store

npm i https://pkg.pr.new/@ngxs/store@2485

@ngxs/websocket-plugin

npm i https://pkg.pr.new/@ngxs/websocket-plugin@2485

commit: ea9b1ad

[bundlemon]

BundleMon

Unchanged files (6)

Status	Path	Size	Limits
❌	fesm2022/ngxs-store.mjs	125.13KB	118KB / +0.5%
✅	fesm2022/ngxs-store-operators.mjs	15.7KB	16KB / +0.5%
✅	fesm2022/ngxs-store-internals.mjs	14.85KB	15KB / +0.5%
✅	fesm2022/ngxs-store-internals-testing.mjs	10.33KB	13KB / +0.5%
✅	fesm2022/ngxs-store-plugins.mjs	2.69KB	3KB / +0.5%
✅	fesm2022/ngxs-store-experimental.mjs	574B	2KB / +0.5%

No change in files bundle size

Unchanged groups (1)

Status	Path	Size	Limits
✅	@ngxs/store(fesm2022)[gzip] ./fesm2022/*.mjs	42.8KB	+1%

Final result: ❌

View report in BundleMon website ➡️

---

Current branch size history | Target branch size history

[bundlemon]

BundleMon (NGXS Plugins)

Unchanged files (9)

Status	Path	Size	Limits
✅	Plugins(fesm2022)[gzip] storage-plugin/fesm2022/ngxs-storage-plugin.m js	5.94KB	+0.5%
✅	Plugins(fesm2022)[gzip] router-plugin/fesm2022/ngxs-router-plugin.mjs	4.5KB	+0.5%
✅	Plugins(fesm2022)[gzip] hmr-plugin/fesm2022/ngxs-hmr-plugin.mjs	2.78KB	+0.5%
✅	Plugins(fesm2022)[gzip] websocket-plugin/fesm2022/ngxs-websocket-plug in.mjs	2.61KB	+0.5%
✅	Plugins(fesm2022)[gzip] form-plugin/fesm2022/ngxs-form-plugin.mjs	2.51KB	+0.5%
✅	Plugins(fesm2022)[gzip] devtools-plugin/fesm2022/ngxs-devtools-plugin .mjs	2.26KB	+0.5%
✅	Plugins(fesm2022)[gzip] logger-plugin/fesm2022/ngxs-logger-plugin.mjs	2.07KB	+0.5%
✅	Plugins(fesm2022)[gzip] storage-plugin/fesm2022/ngxs-storage-plugin-i nternals.mjs	1.21KB	+0.5%
✅	Plugins(fesm2022)[gzip] router-plugin/fesm2022/ngxs-router-plugin-int ernals.mjs	453B	+0.5%

No change in files bundle size

Unchanged groups (1)

Status	Path	Size	Limits
✅	All Plugins(fesm2022)[gzip] ./-plugin/fesm2022/.mjs	24.32KB	+0.5%

Final result: ✅

View report in BundleMon website ➡️

---

Current branch size history | Target branch size history

[bundlemon]

BundleMon (Integration Projects)

Unchanged files (1)

Status	Path	Size	Limits
✅	Main bundles(Gzip) hello-world-ng22/dist-integration/browser/mai n-(hash).js	69.33KB	+1%

No change in files bundle size

Final result: ✅

View report in BundleMon website ➡️

---

Current branch size history | Target branch size history