Vulnerability HighRUSTSEC-2026-0226 · nostr
RUSTSEC-2026-0226: Wallet event parsers accept unauthenticated events
Short answerA security vulnerability in the nostr crate: Wallet event parsers accept unauthenticated events. High severity (CVSS 7.5). Fixed in 0.44.7: update to a fixed version.
| Crate | nostr |
|---|---|
| Type | Vulnerability (crypto-failure) |
| Affected versions | Before 0.44.7. |
| Fixed in | 0.44.7 |
| Severity | High, CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| Published | 2026-08-01 |
| Last changed | 2026-08-02 |
| Also known as | none |
What to do
- See which version you have:
cargo tree -i nostr(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p nostr. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplenostr = "0.44.7") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
The NIP-47 response and notification parsers and the NIP-60 wallet event parsers decrypted relay-provided events before verifying their kind, computed event ID, signature, and expected wallet public key. The decryption peer was derived from the untrusted event author, so successful decryption did not prove that the configured wallet created the event.
An attacker can sign an event with their own key and derive the corresponding shared secret with the victim's public key. A malicious relay delivering that event could therefore cause attacker-chosen encrypted content to be parsed as a response, notification, token, spending record, or quote from the configured wallet. This can corrupt wallet state or cause an application to act on forged wallet data. The issue does not expose the victim's private key or decrypt events authored by the legitimate wallet.
The affected parsers now verify the event kind, ID, signature, and exact configured wallet author before attempting decryption or parsing the plaintext.
References
- Package: crates.io/crates/nostr
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0226.html
- Web: github.com/nostrdevkit/nostr/commit/2b6d6227cd884c1acb200bffa66a3f402b02a176
- Web: github.com/nostrdevkit/nostr/commit/0b78464e39604b0f052862035f47fdabc2a536dd
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for nostr
- Vulnerability HighRUSTSEC-2026-0216 · 2026-07-25Remote Denial of Service via malformed NIP‑44 v2 payload
- Vulnerability HighRUSTSEC-2026-0219 · 2026-07-26Remote Denial of Service via malformed NIP-04 IV
- Vulnerability MediumRUSTSEC-2026-0225 · 2026-08-01Debug output exposes NIP-46 and NIP-60 credentials
- Vulnerability HighRUSTSEC-2026-0227 · 2026-08-01NIP-44 v2 decryption permits resource exhaustion
- Vulnerability MediumRUSTSEC-2026-0228 · 2026-08-01NIP-04 parsing amplifies malformed ciphertext memory use
- Vulnerability HighRUSTSEC-2026-0229 · 2026-08-01NIP-98 authorization parsing permits resource exhaustion
- Vulnerability HighRUSTSEC-2026-0230 · 2026-08-01Empty NIP-50 search filters can panic
Up next
Same cratenostr: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?