CVE-2026-54542: nimiq-primitives Out-of-Bounds Panic in KeyNibbles::Add from Oversized Child Suffix
Summary
CVE-2026-54542: Impact A malicious peer acting as a state-sync source can crash a syncing node with a crafted TrieChunk whose proof contains a TrieNodeChild whose suffix, when concatenated with the parent key via KeyNibbles::Add, exceed... Affects nimiq-primitives versions < 1.6.0. Fixed in 1.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nimiq is a blockchain protocol designed for ease of use and accessibility. The 'nimiq-primitives' package provides essential data structures and algorithms for the Nimiq blockchain, including key management and cryptographic functions. This package is crucial for maintaining the integrity and efficiency of the Nimiq network. However, it is susceptible to a vulnerability that can be exploited during state synchronization, potentially leading to node crashes.
Vulnerability Detail
The vulnerability arises from a flaw in the KeyNibbles::Add function, which does not properly check the combined length of a parent key and a child suffix during deserialization. A malicious peer can exploit this by sending a crafted TrieChunk that causes an out-of-bounds panic when the combined length exceeds 63 bytes. This results in a transient crash of the syncing node, which restarts and attempts to resync, leading to potential denial of service during the synchronization process.
How To Fix
Minimum fixed version
1.6.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that your node only syncs from trusted peers to mitigate the risk of encountering malicious TrieChunks.
Conclusion
The CVE-2026-54542 vulnerability in the 'nimiq-primitives' package poses a risk of out-of-bounds panic during state synchronization. Users are advised to upgrade to version 1.6.0 or later to mitigate this risk. Additionally, syncing only from trusted peers can serve as a temporary workaround.
See every vulnerability recorded for nimiq-primitives →
FAQ
The CVSS score for this vulnerability is 3.7, indicating a low severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If left unaddressed, this vulnerability can lead to transient crashes of your node during state synchronization, potentially disrupting your application's functionality.
Yes, updating to version 1.6.0 or later of the 'nimiq-primitives' package provides a permanent fix for this vulnerability.
Yes, a malicious peer can exploit this vulnerability remotely during the state synchronization process.
References
Related vulnerabilities
Recent vulnerabilities recorded for nimiq-primitives.
