| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| README.md | 2026-10-27 | 1.6 kB | |
| v1.19.2 source code.tar.gz | 2026-10-27 | 6.3 MB | |
| v1.19.2 source code.zip | 2026-10-27 | 7.1 MB | |
| Totals: 3 Items | 13.4 MB | 0 | |
[!WARNING] After upgrading to Flox 1.19.2, we recommend rebooting your system to ensure full remediation.
This release patches CVE-2026-111497, a vulnerability in the Brotli decompression library used by Flox's bundled Nix.
We are not currently aware of a direct exploit against Flox. The Brotli vulnerability could be chained with a compromise of other trusted infrastructure or a MITM attack. An attacker could serve malicious Brotli-compressed data via:
- A Nix substituter.
- An endpoint used to download a flake.
- An endpoint used to download source for packages built from source.
This could potentially allow arbitrary code execution on the host running Flox.
Download Links
- DEB (x86_64-linux)
- DEB (aarch64-linux)
- RPM (x86_64-linux)
- RPM (aarch64-linux)
- OSX (x86_64-darwin)
- OSX (aarch64-darwin)
[!NOTE] You can find the SHA256 checksums for Flox 1.19.2 and SHA512 checksums for Flox 1.19.2 online.
