Description
Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix store to another program running on the host (or another fixed-output derivation) via Unix domain sockets in the abstract namespace. This allows to modify the output of the derivation, after Nix has registered the path as "valid" and immutable in the Nix database. In particular, this allows the output of fixed-output derivations to be modified from their expected content. This issue has been addressed in versions 2.3.18 2.18.2 2.19.4 and 2.20.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| NixOS | nix | >= 2.3.0, < 2.3.18, >= 2.4.0, < 2.18.2, >= 2.19.0, < 2.19.4, >= 2.20.0, < 2.20.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nix | 2.22.1+dfsg-1 | — |
| Debian 13 | nix | 2.22.1+dfsg-1 | — |
| Debian 12 | guix | 1.4.0-3+deb12u1 | DSA-5669-1 |
| Debian 12 | nix | No fix yet | — |
| Debian 11 | guix | 1.2.0-4+deb11u2 | DSA-5669-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | guix | 1.4.0-6ubuntu0.1~esm1 | USN-8773-1 |
| Ubuntu Pro 24.04 LTS | nix | 2.18.1+dfsg-1ubuntu5+esm2 | USN-7633-1 |
| Ubuntu Pro 22.04 LTS | guix | 1.3.0-4ubuntu0.1~esm1 | USN-8773-1 |
| Ubuntu Pro 22.04 LTS | nix | 2.6.0+dfsg-3ubuntu0.1~esm1 | USN-7633-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | guix | 1.4.0-r5 | — |
| Alpine v3.24 | nix | 2.20.5-r0 | — |
| Alpine v3.23 | guix | 1.4.0-r5 | — |
| Alpine v3.23 | nix | 2.20.5-r0 | — |
| Alpine v3.22 | guix | 1.4.0-r5 | — |
| Alpine v3.22 | nix | 2.20.5-r0 | — |
| Alpine v3.21 | guix | 1.4.0-r5 | — |
| Alpine v3.21 | nix | 2.20.5-r0 | — |
| Alpine v3.20 | guix | 1.4.0-r5 | — |
| Alpine v3.20 | nix | 2.20.5-r0 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | guix | 1.4.0-r5 | — |
Advisories 3
- USN-8773-1 guix vulnerability Ubuntu Security Notices (USN) · Sep 16, 2026
- USN-7633-1 nix vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-5669-1 guix - security update Debian Security (DSA / DLA) · Mar 9, 2026