CVE-2021-45707: Nix Project Nix

Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days.

An issue was discovered in the nix crate 0.16.0 and later before 0.20.2, 0.21.x before 0.21.2, and 0.22.x before 0.22.2 for Rust. unistd::getgrouplist has an out-of-bounds write if a user is in more than 16 /etc/groups groups.

Affected products

• Nix Project Nix: from 0.16.0, before 0.20.2 (fixed in 0.20.2); from 0.21.0, before 0.21.2 (fixed in 0.21.2); from 0.22.0, before 0.22.2 (fixed in 0.22.2)

Published 2021-12-27. Last modified 2026-06-17.