Since 072622c7, `nvm_version_path` rejects a version with a `..` path component, printing nothing and returning 3.
`nvm_is_version_installed` ignored that status and appended `/bin/node` to the empty output,
so for such a version (eg, `v/../x` in an `.nvmrc`)
it checked `/bin/node`,
and reported the version as installed whenever a system node lived there.
`nvm use` then put `/bin` in place of the active version on `PATH`,
and `nvm which` printed `/bin/node`.
Propagate `nvm_version_path`'s failure,
so such a version is never installed
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-O1QONH45; the scanner correctly classified it as not a vulnerability.
Jordan Harband
d639676bb0