CVE-2026-34065: nimiq-primitives Node Crash Due to Missing Interlink Validation
Summary
CVE-2026-34065: nimiq-primitives: Node crash due to missing interlink validation in election macro block proposals. Affects nimiq-primitives versions < 0.2.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nimiq-primitives package is a core component of the Nimiq blockchain, providing essential functionalities for handling cryptographic primitives and consensus mechanisms. It is designed to facilitate secure and efficient transactions within the Nimiq network. However, this package has a vulnerability that can be exploited by untrusted peers, leading to potential node crashes.
Vulnerability Detail
The vulnerability arises from the lack of validation for interlinks in election macro block proposals. An untrusted peer can announce an election macro block containing an invalid compressed BLS voting key, which triggers a panic in the node. Specifically, the hashing process of an election macro header reaches the validators' voting keys, where the method validator.voting_key.uncompress().unwrap() is called. If the bytes are invalid, the node will panic, causing a crash.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no known workarounds for this vulnerability. The best course of action is to apply the patch by updating to the latest version of the package.
Conclusion
The CVE-2026-34065 vulnerability in the nimiq-primitives package poses a significant risk by allowing untrusted peers to crash nodes. It is crucial to update to version 1.3.0 or later to mitigate this risk. Regular monitoring and prompt updates are essential for maintaining the security of your application.
See every vulnerability recorded for nimiq-primitives →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Yes, an untrusted peer can exploit this vulnerability by sending a malicious election macro block.
If your node crashes, it may lead to downtime and loss of connectivity to the Nimiq network until the issue is resolved.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using your Cargo.lock file.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for nimiq-primitives.
