nvm resolves a requested version or alias by treating it as a filename under $NVM_DIR/alias. Before 0.40.8, nvm_alias() concatenated the requested name onto that directory and read the result with no containment check, so a name containing a .. component escaped the alias directory; under the default layout an alias such as ../../.npmrc resolves to a file in the user's home directory. nvm_print_alias_file() then emits every non-comment, non-empty line of whatever was opened. A version string taken from an untrusted .nvmrc reaches this path, so a developer who runs nvm use, nvm install, or nvm which inside an attacker-supplied repository discloses the first non-comment line of an arbitrary file readable by that user, in the resulting "is not yet installed" error message. A user-supplied nvm alias <traversing-name> discloses every non-comment line of the target file. There is no integrity or availability impact, and no command execution on this path.
Upgrade to nvm 0.40.8 or later, which rejects any .. path component in nvm_alias() and nvm_version_path().