Memory Consumption Vulnerability in nostr Package: NIP-04 Parsing Issue
Summary
RUSTSEC-2026-0228: NIP-04 parsing amplifies malformed ciphertext memory use. Affects nostr versions >= 0.0.0-0, < 0.44.7. Fixed in 0.44.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The nostr package is a Rust library designed for implementing the Nostr protocol, which facilitates decentralized messaging. It allows users to send encrypted direct messages while maintaining privacy and security. However, the package has a vulnerability in its NIP-04 decryption parser that can lead to excessive memory consumption when processing malformed ciphertext.
Vulnerability Detail
The vulnerability arises from the NIP-04 decryption parser's handling of attacker-controlled content. It splits the input on every ?iv= separator and collects all segments without first verifying that the message contains the expected two parts. Additionally, it Base64-decodes the entire IV text before ensuring it is the correct length for AES-CBC encryption. This flaw allows a malicious sender to craft messages with numerous separators or oversized IVs, leading to excessive memory and CPU usage in clients processing these messages. While this does not compromise the encryption or reveal sensitive information, it can result in denial-of-service conditions.
How To Fix
Minimum fixed version
0.44.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds recommended for this vulnerability. The best course of action is to update to the patched version of the nostr package.
Conclusion
The nostr package has a vulnerability in its NIP-04 parsing mechanism that can lead to excessive memory consumption due to improper handling of malformed ciphertext. It is crucial to update to version 0.44.7 or later to mitigate this risk. Users are encouraged to utilize tools like Vulert for real-time monitoring of open-source vulnerabilities.
See every vulnerability recorded for nostr →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a moderate level of risk.
No, this vulnerability does not weaken NIP-04 encryption or reveal plaintext or key material.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is advisable to monitor your application for unusual memory usage until you can apply the update.
No, the vulnerability is related to the nostr package itself and is not limited to any specific operating system.
References
Related vulnerabilities
Recent vulnerabilities recorded for nostr.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
