Free
Cost
Public registry, no paid plan
Report
Should I Use NuGet Gallery?
The central package repository for NuGet, the package manager for .NET.
Depends
DependsNothing to buy: if you build .NET, this is the default public package registry and you simply use it.
Free public package registry for .NET — essential if you build .NET; irrelevant if you don't; wrong tool for private feeds.
Confidence: Medium
2011
Gallery launched
Per Microsoft .NET Blog
2
CVEs on the Gallery
2024 input flaw, 2026 critical RCE
Value for money
5
Free public infrastructure; nothing to purchase.
Ease of use
4
Built into Visual Studio and dotnet CLI tooling.
Feature depth
4
Automatic dependency handling, rich public metadata API.
Support quality
3
FAQ, status page, GitHub issues; no paid support.
Security posture
2
Critical 2026 RCE CVE plus active typosquatting pressure.
Pros
Cons
Gotchas
- highTyposquatting and dependency-confusion attacks are rising; double-check exact package names before installing.⁹
- highCVE-2026-39399: critical RCE in the gallery's .nuspec handling; watch the status page.⁶
- mediumJuly 2025: Microsoft packages were deleted; team says operator error, not a breach. Keep local mirrors.⁸
- mediumPublic registry only: internal packages require a separate private feed product — extra cost and setup.
Best for
- .NET/C# developers
- Open-source library publishers
- Teams consuming third-party .NET packages
Not for
- Anyone needing private or internal package hosting
- stacks (npm, PyPI, Maven users)
- Buyers wanting vendor support, SLAs, or contracts
- Security teams wanting built-in package vulnerability scanning
Pricing
Free tier: Yes
Security
Two CVEs against the Gallery itself (2024 input flaw, 2026 critical RCE), rising typosquatting pressure; the 2025 deletion incident was officially not a breach.
- CVE-2026-39399 — critical RCECritical vulnerability in the NuGet Gallery backend job's handling of .nuspec files inside packages.⁶
- CVE-2024-47604 — input neutralization flawImproper neutralization of input in the NuGetGallery's handling of HTML element attributes.⁷
- July 2025 package deletionsMicrosoft-published packages were removed; post-mortem attributes it to operator error, not a breach or external attack.⁸
What users say
Users treat NuGet.org as indispensable .NET infrastructure, but the 2025 package-deletion incident and supply-chain chatter eroded some trust.
“There seems to be an ongoing supply chain attack or suspicious activity on NuGet.org”
“Someone suggested a thread on the NuGet home discussions about this, so I made one”
Alternatives
Compare NuGet Gallery with each alternative.
JFrog Artifactory
Enterprise artifact server; host private NuGet feeds plus other formats.
NuGet Gallery vs JFrog ArtifactoryProGet
Self-hosted private NuGet feed server; strong mid-market option.
MyGet
Hosted private NuGet feeds with simple setup.
NuGet Gallery vs MyGetFull analysis
Based on ~30 public sources; user-review depth is thin and no numeric review ratings for the Gallery itself were found.
Sources
- What is NuGet and what does it do?learn.microsoft.comofficial
- NuGet Gallery | Homenuget.orgofficial
review
review
- NuGet Reviews & Ratingstrustradius.comreview
- CVE-2026-39399: NuGet Gallery RCE Vulnerabilitysentinelone.comsecurity
security
official
news
news
Rate this review
Anonymous. You can change your vote.
Loading votes…
Ask a follow-up
Ask if a use case fits. Answers stay inside this report and its sources.
Comments
One queue. No replies. Give a display name first. Limit: 7 comments per day.
No comments yet.