p PatchFirst

CVE-2026-44029

CVE-2026-44029

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An issue was discovered in Nix before 2.34.7. Writing to arbitrary files can occur via "nix-prefetch-url --unpack" or "nix store prefetch-file --unpack" directory traversal. The fixed versions are 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, and 2.28.7 (introduced in 2.24.7);

CVSS 5.3 · Medium · EPSS 0.8% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • nix

    Versions
    • ≥ 2.24.7, < 2.28.7: Affected (semver)
    • ≥ 2.29.0, < 2.29.4: Affected (semver)
    • ≥ 2.30.0, < 2.30.5: Affected (semver)
    • ≥ 2.31.0, < 2.31.5: Affected (semver)
    • ≥ 2.32.0, < 2.32.8: Affected (semver)
    • ≥ 2.33.0, < 2.33.6: Affected (semver)
    • ≥ 2.34.0, < 2.34.7: Affected (semver)

    Update to 2.28.7; Update to 2.29.4; Update to 2.30.5; Update to 2.31.5; Update to 2.32.8; Update to 2.33.6; Update to 2.34.7

  • nix Debian:13

    Versions
    • 2.26.3+dfsg-1
    • 2.32.5+dfsg-1
    • 2.32.5+dfsg-2
    • 2.34.3+dfsg-1
    • 2.34.6+dfsg-1
    • 2.34.8+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nix Debian:14

    Versions
    • 2.26.3+dfsg-1
    • 2.32.5+dfsg-1
    • 2.32.5+dfsg-2
    • 2.34.3+dfsg-1
    • 2.34.6+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 2.34.8+dfsg-1

    Update to 2.34.8+dfsg-1

  • nix Ubuntu:Pro:22.04:LTS

    Versions
    • 2.3.10+dfsg1-1
    • 2.3.10+dfsg1-1build1
    • 2.6.0+dfsg-2
    • 2.6.0+dfsg-3
    • 2.6.0+dfsg-3ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nix Ubuntu:Pro:24.04:LTS

    Versions
    • 2.16.1+dfsg-3ubuntu1
    • 2.18.1+dfsg-1ubuntu1
    • 2.18.1+dfsg-1ubuntu2
    • 2.18.1+dfsg-1ubuntu4
    • 2.18.1+dfsg-1ubuntu5
    • 2.18.1+dfsg-1ubuntu5+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nix Ubuntu:25.10

    Versions
    • 2.24.9+dfsg-2ubuntu2
    • 2.26.3+dfsg-1ubuntu1
    • 2.26.3+dfsg-1ubuntu2
    • 2.26.3+dfsg-1ubuntu4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nix Ubuntu:26.10

    Versions
    • 2.34.3+dfsg-1
    • 2.34.6+dfsg-1
    • 2.34.6+dfsg-1build1
    • 2.34.8+dfsg-1
    • 2.34.8+dfsg-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nix Ubuntu:26.04:LTS

    Versions
    • 2.26.3+dfsg-1ubuntu4
    • 2.26.3+dfsg-1ubuntu5
    • 2.32.5+dfsg-1ubuntu3
    • 2.32.5+dfsg-2ubuntu1
    • 2.34.3+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →