Skip to content

RUSTSEC-2026-0225

Debug output exposes NIP-46 and NIP-60 credentials

Medium crates.io
Severity
5.5 / 10
Medium · CVSS 3.1
Exploit chance (EPSS)
—
No score published
Known exploited
No
Not in CISA's catalog
Weakness
—
Not classified
Fix
0.44.7
Upgrade nostr to this version or later

Description

Several NIP-46 and NIP-60 types used derived Debug implementations even though their fields contained credentials or decrypted application data. Formatting these values exposed NIP-46 connection secrets and request parameters, as well as NIP-60 private keys, Cashu bearer proofs, and quote capability identifiers.

Applications commonly include Debug output in diagnostic logs, tracing spans, or error reports. Anyone able to read those outputs could recover the disclosed credentials and, depending on the value, impersonate a signer connection or spend wallet tokens. The issue does not expose data unless an affected value is formatted and the resulting output is made accessible.

The affected types now use custom Debug implementations that preserve variant and non-sensitive structural information while replacing credentials, bearer values, and plaintext fields with redaction markers. Serialization and protocol behavior are unchanged.

Affected versions

crates.io

PackageVulnerableFixed in
nostr
>= 0.0.0-0, < 0.44.7
0.44.7

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

nostr crates.io → 0.44.7

cargo
cargo update -p nostr --precise 0.44.7

Severity breakdown

CVSS 3.1 5.5

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack vector
Local
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

References

Timeline

  1. Published
  2. Last updated by the source
AdvisorySeverityWhy it's related
RUSTSEC-2026-0230
Empty NIP-50 search filters can panic
High Also affects nostr
RUSTSEC-2026-0229
NIP-98 authorization parsing permits resource exhaustion
High Also affects nostr
RUSTSEC-2026-0226
Wallet event parsers accept unauthenticated events
High Also affects nostr
RUSTSEC-2026-0227
NIP-44 v2 decryption permits resource exhaustion
High Also affects nostr
RUSTSEC-2026-0228
NIP-04 parsing amplifies malformed ciphertext memory use
Medium Also affects nostr
RUSTSEC-2026-0219
Remote Denial of Service via malformed NIP-04 IV
High Also affects nostr
RUSTSEC-2026-0216
Remote Denial of Service via malformed NIP‑44 v2 payload
High Also affects nostr
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor