nostr (crates.io)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 0.45.0-alpha.6 or later clears every advisory below that has a fix.

Upgrade commands

cargo

cargo update -p nostr --precise 0.45.0-alpha.6

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
RUSTSEC-2026-0230 Empty NIP-50 search filters can panic	High	`>= 0.0.0-0, < 0.44.7`	`0.44.7`
RUSTSEC-2026-0225 Debug output exposes NIP-46 and NIP-60 credentials	Medium	`>= 0.0.0-0, < 0.44.7`	`0.44.7`
RUSTSEC-2026-0227 NIP-44 v2 decryption permits resource exhaustion	High	`>= 0.0.0-0, < 0.44.7`	`0.44.7`
RUSTSEC-2026-0226 Wallet event parsers accept unauthenticated events	High	`>= 0.0.0-0, < 0.44.7`	`0.44.7`
RUSTSEC-2026-0229 NIP-98 authorization parsing permits resource exhaustion	High	`>= 0.0.0-0, < 0.44.7`	`0.44.7`
RUSTSEC-2026-0228 NIP-04 parsing amplifies malformed ciphertext memory use	Medium	`>= 0.0.0-0, < 0.44.7`	`0.44.7`
RUSTSEC-2026-0219 Remote Denial of Service via malformed NIP-04 IV	High	`>= 0.0.0-0, < 0.44.6` `>= 0.45.0-alpha.1, < 0.45.0-alpha.6`	`0.44.6` `0.45.0-alpha.6`
RUSTSEC-2026-0216 Remote Denial of Service via malformed NIP‑44 v2 payload	High	`>= 0.0.0-0, < 0.44.5` `>= 0.45.0-alpha.1, < 0.45.0-alpha.5`	`0.44.5` `0.45.0-alpha.5`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor