NuGet "error NU1403: Package content hash validation failed" in CI

By Daniel Zoghalchali·Latchkey

With a lock file or RestorePackagesWithLockFile, NuGet verifies each downloaded package against the recorded hash. NU1403 means the hash did not match: the cached package is corrupt, a feed served a different artifact, or the lock file is stale.

What this error means

dotnet restore fails with "error NU1403: Package content hash validation failed for X.Y.Z. The package may have been tampered with or the local cache is corrupt."

error NU1403: Package content hash validation failed for Newtonsoft.Json.13.0.3.
The package is different than the last restore.

Common causes

A corrupt or partial cached package

A truncated download left a bad package in the global packages folder, so its hash differs from the lock file.

A stale lock file after a feed change

The lock file records a hash from a different feed or a republished artifact, so the served package no longer matches.

How to fix it

Clear the cache and re-restore

1. Clear NuGet's HTTP and global package caches.
2. Re-run restore to fetch fresh, verified copies.
3. If the mismatch persists for the same package, the lock file is stale, not the cache.

dotnet nuget locals all --clear
dotnet restore --force

Regenerate the lock file

When the artifact legitimately changed, re-evaluate the lock so recorded hashes match the feed.

dotnet restore --force-evaluate

How to prevent it

• Restore from one trusted feed so artifacts and hashes stay stable.
• Regenerate the lock file whenever a package version changes.
• Cache the global packages folder consistently across runs.

Frequently asked questions

Related guides

References

• .NET documentation
• GitHub Actions documentation