Vulnerability MediumRUSTSEC-2026-0225 · nostr
RUSTSEC-2026-0225: Debug output exposes NIP-46 and NIP-60 credentials
Short answerA security vulnerability in the nostr crate: Debug output exposes NIP-46 and NIP-60 credentials. Medium severity (CVSS 5.5). Fixed in 0.44.7: update to a fixed version.
| Crate | nostr |
|---|---|
| Type | Vulnerability (file-disclosure) |
| Affected versions | Before 0.44.7. |
| Fixed in | 0.44.7 |
| Severity | Medium, CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| Published | 2026-08-01 |
| Last changed | 2026-08-02 |
| Also known as | none |
What to do
- See which version you have:
cargo tree -i nostr(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p nostr. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplenostr = "0.44.7") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
Several NIP-46 and NIP-60 types used derived Debug implementations even though their fields contained credentials or decrypted application data. Formatting these values exposed NIP-46 connection secrets and request parameters, as well as NIP-60 private keys, Cashu bearer proofs, and quote capability identifiers.
Applications commonly include Debug output in diagnostic logs, tracing spans, or error reports. Anyone able to read those outputs could recover the disclosed credentials and, depending on the value, impersonate a signer connection or spend wallet tokens. The issue does not expose data unless an affected value is formatted and the resulting output is made accessible.
The affected types now use custom Debug implementations that preserve variant and non-sensitive structural information while replacing credentials, bearer values, and plaintext fields with redaction markers. Serialization and protocol behavior are unchanged.
References
- Package: crates.io/crates/nostr
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0225.html
- Web: github.com/nostrdevkit/nostr/commit/2bc5fa2c270bb87b397d381909053f12ee734d44
- Web: github.com/nostrdevkit/nostr/commit/778af7e4930449dcdd7a070774da7b71b282d171
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for nostr
- Vulnerability HighRUSTSEC-2026-0216 · 2026-07-25Remote Denial of Service via malformed NIP‑44 v2 payload
- Vulnerability HighRUSTSEC-2026-0219 · 2026-07-26Remote Denial of Service via malformed NIP-04 IV
- Vulnerability HighRUSTSEC-2026-0226 · 2026-08-01Wallet event parsers accept unauthenticated events
- Vulnerability HighRUSTSEC-2026-0227 · 2026-08-01NIP-44 v2 decryption permits resource exhaustion
- Vulnerability MediumRUSTSEC-2026-0228 · 2026-08-01NIP-04 parsing amplifies malformed ciphertext memory use
- Vulnerability HighRUSTSEC-2026-0229 · 2026-08-01NIP-98 authorization parsing permits resource exhaustion
- Vulnerability HighRUSTSEC-2026-0230 · 2026-08-01Empty NIP-50 search filters can panic
Up next
Same cratenostr: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?