RUSTSEC-2026-0225
Debug output exposes NIP-46 and NIP-60 credentials
- Severity
- 5.5 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
0.44.7- Upgrade nostr to this version or later
Description
Several NIP-46 and NIP-60 types used derived Debug implementations even though
their fields contained credentials or decrypted application data. Formatting these
values exposed NIP-46 connection secrets and request parameters, as well as NIP-60
private keys, Cashu bearer proofs, and quote capability identifiers.
Applications commonly include Debug output in diagnostic logs, tracing spans, or
error reports. Anyone able to read those outputs could recover the disclosed
credentials and, depending on the value, impersonate a signer connection or spend
wallet tokens. The issue does not expose data unless an affected value is formatted
and the resulting output is made accessible.
The affected types now use custom Debug implementations that preserve variant and
non-sensitive structural information while replacing credentials, bearer values,
and plaintext fields with redaction markers. Serialization and protocol behavior are
unchanged.
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| nostr | >= 0.0.0-0, < 0.44.7 |
0.44.7 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
nostr crates.io → 0.44.7
- cargo
cargo update -p nostr --precise 0.44.7
Severity breakdown
CVSS 3.1 5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| RUSTSEC-2026-0230 Empty NIP-50 search filters can panic | High | Also affects nostr |
| RUSTSEC-2026-0229 NIP-98 authorization parsing permits resource exhaustion | High | Also affects nostr |
| RUSTSEC-2026-0226 Wallet event parsers accept unauthenticated events | High | Also affects nostr |
| RUSTSEC-2026-0227 NIP-44 v2 decryption permits resource exhaustion | High | Also affects nostr |
| RUSTSEC-2026-0228 NIP-04 parsing amplifies malformed ciphertext memory use | Medium | Also affects nostr |
| RUSTSEC-2026-0219 Remote Denial of Service via malformed NIP-04 IV | High | Also affects nostr |
| RUSTSEC-2026-0216 Remote Denial of Service via malformed NIP‑44 v2 payload | High | Also affects nostr |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor