EUVD-2026-27163

An issue was discovered in Nix before 2.34.7 and Lix before 2.95.2. Unbounded recursion in the NAR Nix Archive parser could lead to a stack-to-heap overflow when the parser is run on a coroutine stack. The stack is allocated without a guard page, which means that a stack overflow could overwrite...

CVE-2026-44028

An issue was discovered in Nix before 2.34.7 and Lix before 2.95.2. Unbounded recursion in the NAR Nix Archive parser could lead to a stack-to-heap overflow when the parser is run on a coroutine stack. The stack is allocated without a guard page, which means that a stack overflow could overwrite...

DEBIAN-CVE-2026-44028

An issue was discovered in Nix before 2.34.7 and Lix before 2.95.2. Unbounded recursion in the NAR Nix Archive parser could lead to a stack-to-heap overflow when the parser is run on a coroutine stack. The stack is allocated without a guard page, which means that a stack overflow could overwrite...

CVE-2026-44028

CVE-2026-44028 affects Nix and Lix: unbounded recursion in the NAR (Nix Archive) parser can cause a stack-to-heap overflow when parsing on a coroutine stack. The stack lacks a guard page, enabling a stack overflow to overwrite heap memory and potentially execute arbitrary code as the Nix daemon (...

Linux Distros Unpatched Vulnerability : CVE-2026-44028

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Nix before 2.34.7 and Lix before 2.95.2. Unbounded recursion in the NAR Nix Archive parser could lead to a stack-to-heap overflow wh...

Fedora 44 : nix (2026-8c7366e046)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-8c7366e046 advisory. - update to 2.34 - https://nix.dev/manual/nix/2.34/release-notes/rl-2.33.html - https://nix.dev/manual/nix/2.34/release-notes/rl-2.34.html - includes fix for...

Fedora 42 : nix (2026-02fa328deb)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-02fa328deb advisory. - update to 2.31.4 - fixes nix-daemon critical GHSA-g3g9-5vj6-r3gj CVE-2026-39860 - https://github.com/NixOS/nix/security/advisories/GHSA-g3g9-5vj6-r3gj...

CVE-2024-45593

CVE-2024-45593 affects the Nix package manager. A bug in Nix 2.24 prior to 2.24.6 lets a substituter or malicious user craft a NAR that, when unpacked by Nix, writes to arbitrary filesystem locations accessible to the Nix process, with root privileges when using the Nix daemon. Multiple connected...