Executive brief
NuGet is a package manager used by developers to download and manage software libraries in .NET applications. A security update has been released to improve how NuGet verifies the identity and version of packages during the download process. Without this update, there is a theoretical risk that a malicious actor could interfere with package downloads, potentially leading to the installation of untrusted code.
Technical details
This is a defense-in-depth security update for the NuGet Client (including NuGet.exe and related libraries) and the .NET SDK. The update addresses CWE-345 (Insufficient Verification of Data Authenticity) by adding explicit validation of the package ID and version during the download phase, supplementing existing package signature verification. This hardening measure is intended to prevent potential exploitation of vulnerabilities in the package ecosystem, such as those involving metadata confusion or URI truncation in backend services. The update is available across multiple major versions of NuGet and the .NET SDK.
Affected products
- Microsoft NuGet.CommandLine >= 4.9.0, <= 4.9.6; >= 5.11.0, <= 5.11.6; >= 6.8.0, <= 6.8.1; >= 6.11.0, <= 6.11.1; >= 6.12.0, <= 6.12.4; >= 6.14.0, <= 6.14.2; >= 7.0.0, <= 7.0.2; 7.3.0
- Microsoft NuGet.Packaging >= 4.9.0, <= 4.9.6; >= 5.11.0, <= 5.11.6; >= 6.8.0, <= 6.8.1; >= 6.11.0, <= 6.11.1; >= 6.12.0, <= 6.12.4; >= 6.14.0, <= 6.14.2; >= 7.0.0, <= 7.0.2; 7.3.0
- Microsoft NuGet.Protocol >= 4.9.0, <= 4.9.6; >= 5.11.0, <= 5.11.6; >= 6.8.0, <= 6.8.1; >= 6.11.0, <= 6.11.1; >= 6.12.0, <= 6.12.4; >= 6.14.0, <= 6.14.2; >= 7.0.0, <= 7.0.2; 7.3.0
- Microsoft .NET SDK 8.0.100-8.0.125, 8.0.400-8.0.419, 9.0.100-9.0.115, 9.0.300-9.0.312, 10.0.100-10.0.105, 10.0.200-10.0.201
Timeline
- 2026-04-14: disclosed
- 2026-04-14: patched
- 2026-04-14: advisory