Vulnerability HighRUSTSEC-2026-0230 · nostr
RUSTSEC-2026-0230: Empty NIP-50 search filters can panic
Short answerA security vulnerability in the nostr crate: Empty NIP-50 search filters can panic. High severity (CVSS 7.5). Fixed in 0.44.7: update to a fixed version.
| Crate | nostr |
|---|---|
| Type | Vulnerability (denial-of-service) |
| Affected versions | Before 0.44.7. |
| Fixed in | 0.44.7 |
| Severity | High, CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| Published | 2026-08-01 |
| Last changed | 2026-08-02 |
| Also known as | none |
What to do
- See which version you have:
cargo tree -i nostr(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p nostr. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplenostr = "0.44.7") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
The NIP-50 event-matching path searched event content with slice::windows(search.len()). An empty search string therefore called slice::windows(0), which always panics instead of returning a match result.
A remote client able to submit filters to an application using this matcher could trigger the panic with an empty NIP-50 search value. This includes clients querying an SDK local relay. Depending on the application's panic configuration and task isolation, the crafted filter could terminate request processing, a runtime worker, or the entire process, causing denial of service. No confidentiality or integrity impact is known.
Empty searches are now handled before the substring search, so the matcher returns a defined result without constructing a zero-sized window or panicking.
References
- Package: crates.io/crates/nostr
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0230.html
- Web: github.com/nostrdevkit/nostr/commit/29182657bc54ac18564597e4414f08c3e4e9aa0a
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for nostr
- Vulnerability HighRUSTSEC-2026-0216 · 2026-07-25Remote Denial of Service via malformed NIP‑44 v2 payload
- Vulnerability HighRUSTSEC-2026-0219 · 2026-07-26Remote Denial of Service via malformed NIP-04 IV
- Vulnerability MediumRUSTSEC-2026-0225 · 2026-08-01Debug output exposes NIP-46 and NIP-60 credentials
- Vulnerability HighRUSTSEC-2026-0226 · 2026-08-01Wallet event parsers accept unauthenticated events
- Vulnerability HighRUSTSEC-2026-0227 · 2026-08-01NIP-44 v2 decryption permits resource exhaustion
- Vulnerability MediumRUSTSEC-2026-0228 · 2026-08-01NIP-04 parsing amplifies malformed ciphertext memory use
- Vulnerability HighRUSTSEC-2026-0229 · 2026-08-01NIP-98 authorization parsing permits resource exhaustion
Up next
Same cratenostr: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?