nx
23.3.2The Monorepo Platform that amplifies both developers and AI agents. Nx optimizes your builds, scales your CI, and fixes failed PRs automatically. Ship in half the time.
- Maintenance
- Active851 commits in 3 months · bus factor 5
- License
- MITPermissive · OSI-approved
- Security
- 8 advisories1 critical, 5 high, 2 medium · Scorecard 7.9/10
- Supported versions
- No scheduleendoflife.date does not track this project
29.5k stars · 3k forks · 489 open issues · last release 2 days ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 8 most recent advisories published by the maintainers: 1 critical, 5 high, 2 medium. Check the patched version against the one you run.
- highCVE-2026-119282Sep 11, 2026OS command injection via nx.json plugin options in @nx/maven and @nx/gradle
- Affected
- >= 22.0.2, < 22.7.9; >= 23.0.0, < 23.1.2; >= 21.0.0, < 22.7.9
- Patched in
- 22.7.9; 23.1.2
- highCVE-2026-104859Sep 11, 2026OS command injection in the @nx/docker release pipeline
- Affected
- >= 21.4.0, < 22.7.8; >= 23.0.0, < 23.1.1
- Patched in
- 22.7.8; 23.1.1
- highGHSA-w2vw-w76x-qr89Sep 11, 2026OS command injection via git revisions and remote refs in Nx
- Affected
- >= 14.0.0, < 22.7.8; >= 23.0.0, < 23.1.1
- Patched in
- 22.7.8; 23.1.1
- highCVE-2026-104854Sep 11, 2026Nx daemon and plugin worker sockets are accessible to other local users
- Affected
- >= 14.6.0, < 22.7.9; >= 23.0.0, < 23.1.2
- Patched in
- 22.7.9; 23.1.2
- mediumCVE-2026-104853Sep 11, 2026Path traversal in nx migrate package-migrations extraction
- Affected
- >= 13.10.0, < 22.7.10; >= 23.0.0, < 23.2.1
- Patched in
- 22.7.10; 23.2.1
- highCVE-2026-71476Jul 10, 2026Zip-Slip in the Nx self-hosted remote cache
- Affected
- >= 20.8.0 <= 22.7.6, 23.0.0, 23.0.1; *
- Patched in
- > 23.0.2, 22.7.7; N/a
- mediumCVE-2026-54753Jun 9, 2026`nx graph` dev server permissive CORS policy
- Affected
- `>= 17.0.4, < 22.7.2` and `>= 23.0.0-beta.0, < 23.0.0-beta.2`
- Patched in
- >= 22.7.2
- criticalGHSA-cxm3-wv7p-598cAug 27, 2025Malicious versions of Nx and some supporting plugins were published
- Affected
- 21.5.0, 20.9.0, 20.10.0, 21.6.0, 20.11.0, 21.7.0, 21.8.0, 20.12.0; 3.2.0; 21.5.0, 20.9.0; 21.5.0
- Patched in
- Any other version (malicious packages have been deleted from npm)