CVE-2026-54541: nimiq-primitives - Panic in TrieProof::verify due to Child Index Unwrap on Equal-Length Keys
Summary
CVE-2026-54541: nimiq-primitives: Panic in TrieProof::verify via child_index unwrap on equal-length keys. Affects nimiq-primitives versions < 1.6.0. Fixed in 1.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nimiq-primitives is a core library used in the Nimiq blockchain ecosystem, providing essential functionalities for handling cryptographic proofs and trie structures. This library is integral for state synchronization among nodes, ensuring data integrity and consistency across the network. However, it is susceptible to a specific vulnerability that can be exploited during the state synchronization process.
Vulnerability Detail
The vulnerability arises from a flaw in the TrieProof::verify method, where it unconditionally unwraps a value derived from child_index based on the length of keys. If two TrieProofNode instances with identical keys are processed, the method will panic due to an attempt to unwrap a None value. This can be triggered by a malicious peer sending a crafted TrieChunk, leading to a crash of the syncing node. The panic occurs before any cryptographic proof verification, allowing an attacker to exploit this without needing a valid proof. The crash is transient, causing the node to restart and re-sync, which can disrupt network operations.
How To Fix
Minimum fixed version
1.6.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that your node only syncs from trusted peers to mitigate the risk of encountering malicious TrieChunks.
Conclusion
The CVE-2026-54541 vulnerability in the nimiq-primitives package poses a risk of node crashes during state synchronization due to a panic in the TrieProof::verify method. Upgrading to version 1.6.0 or later is essential to mitigate this issue. Users are also advised to sync only from trusted peers as a temporary measure.
See every vulnerability recorded for nimiq-primitives →
FAQ
The vulnerability can cause a node to crash during state synchronization, leading to potential disruptions in network operations.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 3.7, indicating a low severity level.
Yes, upgrading to version 1.6.0 or later of the nimiq-primitives package provides a permanent fix for this vulnerability.
If an immediate upgrade is not possible, ensure that your node only syncs from trusted peers to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for nimiq-primitives.
