RUSTSEC-2026-0226
Wallet event parsers accept unauthenticated events
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
0.44.7- Upgrade nostr to this version or later
Description
The NIP-47 response and notification parsers and the NIP-60 wallet event parsers decrypted relay-provided events before verifying their kind, computed event ID, signature, and expected wallet public key. The decryption peer was derived from the untrusted event author, so successful decryption did not prove that the configured wallet created the event.
An attacker can sign an event with their own key and derive the corresponding shared secret with the victim's public key. A malicious relay delivering that event could therefore cause attacker-chosen encrypted content to be parsed as a response, notification, token, spending record, or quote from the configured wallet. This can corrupt wallet state or cause an application to act on forged wallet data. The issue does not expose the victim's private key or decrypt events authored by the legitimate wallet.
The affected parsers now verify the event kind, ID, signature, and exact configured wallet author before attempting decryption or parsing the plaintext.
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| nostr | >= 0.0.0-0, < 0.44.7 |
0.44.7 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
nostr crates.io → 0.44.7
- cargo
cargo update -p nostr --precise 0.44.7
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| RUSTSEC-2026-0230 Empty NIP-50 search filters can panic | High | Also affects nostr |
| RUSTSEC-2026-0229 NIP-98 authorization parsing permits resource exhaustion | High | Also affects nostr |
| RUSTSEC-2026-0227 NIP-44 v2 decryption permits resource exhaustion | High | Also affects nostr |
| RUSTSEC-2026-0225 Debug output exposes NIP-46 and NIP-60 credentials | Medium | Also affects nostr |
| RUSTSEC-2026-0228 NIP-04 parsing amplifies malformed ciphertext memory use | Medium | Also affects nostr |
| RUSTSEC-2026-0219 Remote Denial of Service via malformed NIP-04 IV | High | Also affects nostr |
| RUSTSEC-2026-0216 Remote Denial of Service via malformed NIP‑44 v2 payload | High | Also affects nostr |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor