NixOS nix vulnerabilities

CVEs per yearBy the year they were published

1. 20245
2. 20256
3. 20269

Newest CVEs

• CVE-2026-110453

  Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients.

  NixOS · Nix

  Medium4.3
• CVE-2026-110452

  The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root…

  NixOS · Nix

  Medium4.0
• CVE-2026-110451

  Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled.

  NixOS · Nix

  Medium4.3
• CVE-2026-110450

  Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content…

  NixOS · Nix

  High8.0
• CVE-2026-110449

  Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list…

  NixOS · Nix

  High7.5
• CVE-2026-64846

  Nix: Arbitrary file truncation outside the sandbox with recursive-nix experimental feature

  NixOS · nix

  Low2.8
• CVE-2026-44029

  An issue was discovered in Nix before 2.34.7. Writing to arbitrary files can occur via "nix-prefetch-url --unpack" or "nix store prefetch-file --unpack"…

  NixOS · Nix

  Medium5.3
• CVE-2026-44028

  An issue was discovered in Nix before 2.34.7 and Lix before 2.95.2. Unbounded recursion in the NAR (Nix Archive) parser could lead to a stack-to-heap overflow…

  NixOS · Nix

  High7.5
• CVE-2026-39860

  Nix sandbox escape: file write via symlink at FOD `.tmp` copy destination

  NixOS · nix

  Critical9.0
• CVE-2025-53819

  Nix's privilege dropping to build user broke for macOS

  NixOS · nix

  High7.9