Sonatype Nexus Repository: known vulnerabilities by version

Sonatype lists 199 Nexus Repository 3.x versions, and every one of them carries at least one known CVE. 70 CVEs are on record. Latest release: 3.97.2 (October 23, 2026).

A lookup, not a scan of your server. From NVD and Sonatype's own records, pulled October 23, 2026. Nexus Repository 2 is not covered. What end of life means for Nexus Repository 2.

Paste the version your server reports. Build suffixes such as -03 and a leading v are fine.

Not sure which version you run? A Nexus server can report it in its Server header. curl -sI https://your-nexus-host/ | grep -i '^server:' prints a line like Server: Nexus/3.76.0-03 (OSS). Paste that line here.

Tired of patching Nexus yourself?

This is what we do. We host your Maven, npm, PyPI and Docker repositories, so there's no Nexus server to upgrade or patch.

Our migration tool, free to use with CloudRepo, moves your hosted repositories over from Nexus 3 and checks every file.

Start free trial

14 days free. No credit card required.

Or book a call with Chris

Every version, by support status

Newest branch first. The support status is read from Sonatype's published support dates as of October 23, 2026, the day the data was pulled. Each version links to its page and shows its known-CVE count.

Follow new CVEs (RSS)

General Availability

12 branches, 42 versions
3.97.x
3.96.x
3.95.x
3.94.x
3.93.x
3.92.x
3.91.x
3.90.x
3.89.x
3.88.x
3.87.x
3.86.x

Extended Maintenance

6 branches, 13 versions
3.85.x
3.84.x
3.83.x
3.82.x
3.81.x
3.80.x

Sunsetted

51 branches, 85 versions
3.79.x
3.78.x
3.77.x
3.76.x
3.75.x
3.74.x
Show 45 more branches, down to 3.29.x
3.73.x
3.72.x
3.71.x
3.70.x
3.69.x
3.68.x
3.67.x
3.66.x
3.65.x
3.64.x
3.63.x
3.62.x
3.61.x
3.60.x
3.59.x
3.58.x
3.57.x
3.56.x
3.55.x
3.54.x
3.53.x
3.52.x
3.51.x
3.50.x
3.49.x
3.48.x
3.47.x
3.46.x
3.45.x
3.44.x
3.43.x
3.42.x
3.41.x
3.40.x
3.39.x
3.38.x
3.37.x
3.36.x
3.35.x
3.34.x
3.33.x
3.32.x
3.31.x
3.30.x
3.29.x

Not listed

29 branches, 59 versions

These predate Sonatype's versions status page.

3.28.x
3.27.x
3.26.x
3.25.x
3.24.x
3.23.x
Show 23 more branches, down to 3.0.x
3.22.x
3.21.x
3.20.x
3.19.x
3.18.x
3.17.x
3.16.x
3.15.x
3.14.x
3.13.x
3.12.x
3.11.x
3.10.x
3.9.x
3.8.x
3.7.x
3.6.x
3.5.x
3.4.x
3.3.x
3.2.x
3.1.x
3.0.x
Sources and method

Sonatype's policy: Sonatype Nexus Repository releases are considered generally available and fully supported for a term of 1 year after the version's release date. Sonatype provides extended maintenance for each Sonatype Nexus Repository version for an additional 6 months before that version is considered sunset.

Sources: NVD (exact CPE match and the published configurations), the CVE Program record (the vendor's CNA entry with its affected and fixed versions), Sonatype's security advisories, release notes and end-of-life page. Pulled October 23, 2026. Every CVE row links to its NVD record and to the vendor's advisory.

Next