# Vulnerability in Nix 2.24

**URL:** https://discourse.nixos.org/t/vulnerability-in-nix-2-24/51902
**Category:** Security
**Created:** [September 10, 2024, 10:22am UTC](https://discourse.nixos.org/t/vulnerability-in-nix-2-24/51902 "2024-09-10T10:22:10Z")
**Posts on this page:** 1
**Showing post:** 8

<div class="post-metadata">

### Author: ![fricklerhandwerk](https://discourse.nixos.org/user_avatar/discourse.nixos.org/fricklerhandwerk/32/2029_2.png) [@fricklerhandwerk](https://discourse.nixos.org/u/fricklerhandwerk)
#### Post date: [September 17, 2024, 8:51pm UTC](https://discourse.nixos.org/t/vulnerability-in-nix-2-24/51902/8 "2024-09-17T20:51:03Z")

</div>

Here’s the post mortem as promised:

> [@NAR unpacking vulnerability -- post mortem](https://discourse.nixos.org/t/nar-unpacking-vulnerability-post-mortem/52301):
>
> Last week there was a period of 14 hours where the mechanism of a [serious security vulnerability in Nix 2.24](https://discourse.nixos.org/t/vulnerability-in-nix-2-24/51902) was publicly known but no patch available. The following reconstructs what led up to that, and lists the conclusions Nix maintainers (@edolstra @tomberek @Ericson2314 @roberth @fricklerhandwerk) draw from the incident. Summary of events Nix maintainers were first informed of the vulnerability on Friday 2024-08-30 on Matrix by @puckipedia, with an advance warning on GitHub by @jade. @tomb…

---

_[View the full topic](https://discourse.nixos.org/t/vulnerability-in-nix-2-24/51902)._