CVE-2026-46545: nimiq-primitives Denial of Service via ROOT-keyed Item in Trie Chunk Processing
Summary
CVE-2026-46545: nimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed item. Affects nimiq-primitives versions < 1.5.0. Fixed in 1.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nimiq-primitives package is a core component of the Nimiq blockchain, providing essential data structures and algorithms for managing state and transactions. It utilizes a Merkle Radix Trie for efficient storage and retrieval of blockchain data. However, this package is vulnerable to a denial-of-service attack due to improper handling of specific trie items, particularly those keyed with the ROOT key.
Vulnerability Detail
A remote, unauthenticated denial-of-service vulnerability exists in the MerkleRadixTrie::put_chunk method. An attacker can exploit this by sending a malicious ResponseChunk containing a TrieItem with the empty ROOT key. This causes the node to panic and crash when it attempts to store a value at the root node, as the operation is not permitted. The vulnerability affects any node performing state synchronization against untrusted peers, making it a significant risk for both new and recovering nodes.
How To Fix
Latest published version: 1.7.2 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no safe in-process workarounds available, as any peer serving state-sync data can trigger the crash. It is recommended to avoid connecting to untrusted peers until the vulnerability is patched.
Conclusion
The CVE-2026-46545 vulnerability in the nimiq-primitives package poses a significant risk of denial-of-service attacks through improper handling of trie chunks. It is crucial for users to update to the patched version to mitigate this risk and ensure the stability of their nodes.
See every vulnerability recorded for nimiq-primitives →
FAQ
The vulnerability allows a remote attacker to crash a node by sending a specially crafted trie chunk with a ROOT-keyed item.
Any node running state synchronization against untrusted peers is affected, including fresh nodes and those recovering from data loss.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
Yes, a patch is available in version 1.5.0 of the nimiq-primitives package. Updating to this version will resolve the issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for nimiq-primitives.
