# Install cargo-fuzz with Homebrew, Nix, pacman Command-line helpers for fuzzing. Version 0.13.2 via Homebrew; verified 2026-06-09. ## Install ```sh sudo av install brew:cargo-fuzz ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install cargo-fuzz ``` Evidence: local Homebrew formula metadata ### Linux - Nix (92%): ```sh nix profile install nixpkgs#cargo-fuzz ``` Evidence: nixpkgs package indexes: pkgs/by-name/ca/cargo-fuzz/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - pacman (92%): ```sh sudo pacman -S cargo-fuzz ``` Evidence: Arch Linux sync databases: cargo-fuzz from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz ## Package facts - **Package key:** brew:cargo-fuzz - **Package manager:** Homebrew - **Package manager page:** - **Version:** 0.13.2 - **Source summary:** Command-line helpers for fuzzing - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** Apache-2.0 AND MIT - **Source archive:** - **Last updated:** 2026-06-09T23:51:17Z - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - cargo-fuzz (cli) - cargo-fuzz (alias) ## Build dependencies - rust ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 0.13.2 - Package-manager updated: 2026-06-09 - Local data: ok - Upstream repository: https://github.com/rust-fuzz/cargo-fuzz - Upstream latest detected: 0.13.2 (current) ## Project history and usage cargo-fuzz is the standard Cargo subcommand for driving libFuzzer against Rust crates. It is part of the rust-fuzz project family and is documented by the Rust Fuzz Book as the recommended tool for fuzz testing Rust code. The package matters because it made coverage-guided fuzzing feel like an ordinary Rust workflow: initialize a fuzz target, add test harnesses, run them through Cargo, minimize failing inputs, and generate coverage. ### Project history The cargo-fuzz repository and crate were created in February 2017, early in Rust's effort to make fuzz testing practical for library authors. The README describes it as a Cargo subcommand for fuzzing with libFuzzer, while the Rust Fuzz Book clarifies that cargo-fuzz invokes a fuzzer rather than being a fuzzer itself. The tool standardized the `fuzz/` directory layout for Rust crates. `cargo fuzz init` creates a fuzzing project, `cargo fuzz add` creates targets, and `cargo fuzz run` executes them through libFuzzer via the libfuzzer-sys crate. ### Adoption history cargo-fuzz became the mainstream Rust path for libFuzzer-based testing because it followed Cargo conventions and came with an official guide. The Rust Fuzz Book places it alongside afl.rs but explicitly recommends cargo-fuzz for Rust code. The rust-fuzz ecosystem also keeps a trophy-case repository for bugs found through fuzz testing, reinforcing cargo-fuzz as part of Rust's security and reliability culture rather than a standalone experiment. ### How it is used Typical usage begins with `cargo fuzz init`, then `cargo fuzz add `, and then `cargo fuzz run `. The README also documents commands for formatting generated inputs, minimizing a crashing testcase, minimizing corpora, and collecting coverage. The README notes important platform constraints: libFuzzer needs LLVM sanitizer support, Unix-like operating systems for the primary workflow, a nightly compiler for unstable flags, and a C++11 compiler. ### Why package nerds care cargo-fuzz is one of the clearest examples of Cargo's subcommand model turning advanced compiler/runtime machinery into a discoverable package. It hides LLVM sanitizer and libFuzzer details behind a small command set that Rust maintainers can add to CI and security workflows. For package-history work, it also marks a moment when fuzzing moved from specialist security tooling into normal Rust package maintenance. ### Timeline - 2017-02-21: GitHub repository created and cargo-fuzz 0.1.0 published to crates.io. - 2017: Rust Fuzz Book documents cargo-fuzz as a recommended Rust fuzzing path. - 2020s: The tool grows commands for testcase minimization, corpus minimization, and coverage reporting. - 2026: Crate has more than 3 million crates.io downloads and remains active under rust-fuzz. ### Related projects - libFuzzer is the fuzzing engine invoked by cargo-fuzz through libfuzzer-sys. - The Rust Fuzz Book also documents afl.rs as another Rust fuzzing tool. - rust-fuzz/trophy-case collects bugs found by cargo-fuzz and other fuzzing tools. ### Sources - - - - - ## Security Notes narrow executable package without higher-risk signals. - **Geiger risk:** green / low - narrow executable package without higher-risk signals ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: fuzz/Cargo.toml ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** cargo-fuzz - **Version Scheme:** 0 - **Revision:** 0 - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** stable ## Other Package-Manager Records - Nix - cargo-fuzz: normalized package name match | nixpkgs package indexes: pkgs/by-name/ca/cargo-fuzz/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - pacman - cargo-fuzz - 0.13.1-3: normalized package name match | Arch Linux sync databases: cargo-fuzz from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Command line helpers for fuzzing rust | https://github.com/rust-fuzz/cargo-fuzz ## Related links - [Source-control packages](https://www.automicvault.com/pkg/source-control-tools/) - Belongs to a source-control command family. - [Package publisher tools](https://www.automicvault.com/pkg/package-publishers/) - Belongs to a package publishing or registry command family. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Text processing packages](https://www.automicvault.com/pkg/text-processing-tools/) - Matched text, document, or structured-data processing metadata. - [rust](https://www.automicvault.com/pkg/brew/rust/) - Build dependency declared by Homebrew. - [cargo-hack](https://www.automicvault.com/pkg/brew/cargo-hack/) - Shares av.db curated category or tags: cargo, cli, developer-tools, rust, testing. - [cargo-insta](https://www.automicvault.com/pkg/brew/cargo-insta/) - Shares av.db curated category or tags: cargo, cli, developer-tools, rust, testing. - [cargo-nextest](https://www.automicvault.com/pkg/brew/cargo-nextest/) - Shares av.db curated category or tags: cargo, cli, developer-tools, rust, testing. - [zzuf](https://www.automicvault.com/pkg/brew/zzuf/) - Shares av.db curated category or tags: cli, developer-tools, fuzzing, testing. - [allure](https://www.automicvault.com/pkg/brew/allure/) - Shares av.db curated category or tags: cli, developer-tools, testing. - [artillery](https://www.automicvault.com/pkg/brew/artillery/) - Shares av.db curated category or tags: cli, developer-tools, testing. - [busted](https://www.automicvault.com/pkg/brew/busted/) - Shares av.db curated category or tags: cli, developer-tools, testing. - [bzt](https://www.automicvault.com/pkg/brew/bzt/) - Shares av.db curated category or tags: cli, developer-tools, testing. - [cargo-fuzz](https://www.automicvault.com/pkg/cargo/cargo-fuzz/) - Same normalized package name exists in another local package ecosystem. ## Combined YAML source View the package source record on GitHub. [combined/cargo-fuzz.yml](https://github.com/automic-vault/db/blob/main/combined/cargo-fuzz.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph