Medium · 4.3 CVE-2026-110453 EUVD-2026-100809GHSA-cm63-px87-wf8p

Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients.

Published Oct 14, 2026 · Updated Oct 19, 2026 · Assigned by mitre

Description

Vendor	Product	Affected	Fixed
NixOS	Nix	< 2.28.8, 2.29.0 – < 2.30.6, 2.31.0 – < 2.31.6, 2.32.0 – < 2.34.9, 2.35.0 – < 2.35.3	2.28.8