shouldiuse.io

Categories

VERDICT

NuGet Gallery Review

Depends

Should I use NuGet Gallery?

The central package repository for NuGet, the package manager for .NET. - nuget.org

· 1 month ago

Nothing to buy: if you build .NET, this is the default public package registry and you simply use it. Don't lean on it for private feeds, vendor support, or non-.NET ecosystems — that's what feed servers like Artifactory or ProGet are for.

Confidence

Medium. Based on ~30 public sources; user-review depth is thin and no numeric review ratings for the Gallery itself were found.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support quality
  • Security posture

Pricing

Not disclosed

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes

Best for

  • .NET/C# developers
  • Open-source library publishers
  • Teams consuming third-party .NET packages

Not for

  • Anyone needing private or internal package hosting
  • stacks (npm, PyPI, Maven users)
  • Buyers wanting vendor support, SLAs, or contracts
  • Security teams wanting built-in package vulnerability scanning

Gotchas - check before you buy

high

Typosquatting and dependency-confusion attacks are rising; double-check exact package names before installing.

high

CVE-2026-39399: critical RCE in the gallery's .nuspec handling; watch the status page.

medium

July 2025: Microsoft packages were deleted; team says operator error, not a breach. Keep local mirrors.

medium

Public registry only: internal packages require a separate private feed product — extra cost and setup.

Pros and cons

Pros

  • Default, central package repository for all .NET authors and consumers
  • Automatically handles package dependencies
  • Open-source manager streamlines integrating third-party libraries into projects
  • Public API exposes versions, downloads, authors, licenses, and tags

Cons

  • July 2025 mass package-deletion incident disrupted publishers
  • 2026 critical RCE vulnerability in the gallery backend
  • Active typosquatting and supply-chain attack concerns
  • No private feeds — you need ProGet, MyGet, or Artifactory

Sources & method

- 10 sources - Two CVEs against the Gallery itself (2024 input flaw, 2026 critical RCE), rising typosquatting pressure; the 2025 deletion incident was officially not a breach.

official x3review x3security x2news x2
  • CVE-2026-39399 — critical RCE, Critical vulnerability in the NuGet Gallery backend job's handling of .nuspec files inside packages.
  • CVE-2024-47604 — input neutralization flaw, Improper neutralization of input in the NuGetGallery's handling of HTML element attributes.
  • July 2025 package deletions, Microsoft-published packages were removed; post-mortem attributes it to operator error, not a breach or external attack.

Key stats

  • Value for money: 5/5

    Rating

  • Not disclosed

    Starting price

  • 10

    Sources

  • Analyzed

  • Value for money: 5/5. Free public infrastructure; nothing to purchase.
  • Ease of use: 4/5. Built into Visual Studio and dotnet CLI tooling.
  • Feature depth: 4/5. Automatic dependency handling, rich public metadata API.
  • Support quality: 3/5. FAQ, status page, GitHub issues; no paid support.
  • Security posture: 2/5. Critical 2026 RCE CVE plus active typosquatting pressure.
  • Free Cost Public registry, no paid plan
  • 2011 Gallery launched Per Microsoft .NET Blog
  • 2 CVEs on the Gallery 2024 input flaw, 2026 critical RCE

Pricing

Free tier: Yes

Security

Two CVEs against the Gallery itself (2024 input flaw, 2026 critical RCE), rising typosquatting pressure; the 2025 deletion incident was officially not a breach.

  • CVE-2026-39399 — critical RCECritical vulnerability in the NuGet Gallery backend job's handling of .nuspec files inside packages.⁶
  • CVE-2024-47604 — input neutralization flawImproper neutralization of input in the NuGetGallery's handling of HTML element attributes.⁷
  • July 2025 package deletionsMicrosoft-published packages were removed; post-mortem attributes it to operator error, not a breach or external attack.⁸

What users say

Users treat NuGet.org as indispensable .NET infrastructure, but the 2025 package-deletion incident and supply-chain chatter eroded some trust.

“There seems to be an ongoing supply chain attack or suspicious activity on NuGet.org”
Reddit, r/dotnet
“Someone suggested a thread on the NuGet home discussions about this, so I made one”
Reddit, r/dotnet

Companies that use it

  • Microsoft²
  • QuestPDF²
  • Iron Software
  • uSkinned Site Builder
Full analysis

Based on ~30 public sources; user-review depth is thin and no numeric review ratings for the Gallery itself were found.

Free public package registry for .NET — essential if you build .NET; irrelevant if you don't; wrong tool for private feeds.

Methodology

Based on ~30 public sources; user-review depth is thin and no numeric review ratings for the Gallery itself were found.

Read how a report is made.

Sources

  1. What is NuGet and what does it do?learn.microsoft.com
    official
  2. NuGet Gallery | Homenuget.org
    official
  3. NuGet: A Step-by-Step Guide to Publishing Your Own Packagesgoatreview.com
    review
  4. Top 10 ProGet Alternatives & Competitorsg2.com
    review
  5. NuGet Reviews & Ratingstrustradius.com
    review
  6. CVE-2026-39399: NuGet Gallery RCE Vulnerabilitysentinelone.com
    security
  7. CVE-2024-47604: Improper Neutralization of Inputrapid7.com
    security
  8. NuGet.org Package Deletion – Learnings & Preventiongithub.com
    official
  9. NuGet Typosquatting Explained: .NET Supply Chain Attackssafeguard.sh
    news
  10. NuGet gallery supply chain attack? (Reddit)reddit.com
    news

Add this review to your site

This check for NuGet Gallery says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Depends NuGet Gallery Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.