Integrity Compromise in nostr-relay-pool: Unverified Relay Event Processing
Summary
RUSTSEC-2026-0232: Processing of unverified relay events. Affects nostr-relay-pool versions >= 0.0.0-0, < 0.44.3. Fixed in 0.44.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nostr-relay-pool is a Rust-based library designed for managing and processing relay events in the Nostr protocol. It facilitates the handling of events by providing a structured way to interact with relays, ensuring efficient communication and data integrity. However, it is susceptible to vulnerabilities that can undermine the integrity of the events processed, particularly through unverified relay events.
Vulnerability Detail
The vulnerability arises from the processing of events received from a relay without adequate verification of their authenticity. Specifically, the library failed to ensure that the serialized fields of an event matched the claimed event ID and signature before processing. This oversight allows a malicious relay to send forged events that appear to be legitimate, potentially leading to unauthorized policy evaluations and SDK processing. The verification cache's reliance on a 64-bit hash instead of the complete event ID further exacerbates the issue, as it can lead to cache-key collisions. While this vulnerability does not expose private keys or allow the attacker to create valid signatures, it significantly undermines event integrity.
How To Fix
Latest published version: 0.44.3 as of 22 Oct 2026
The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched version as soon as possible.
Conclusion
The nostr-relay-pool package has a significant vulnerability related to the processing of unverified relay events, which can compromise event integrity. It is essential to update to version 0.44.3 or later to ensure proper verification of events and maintain the security of your application.
See every vulnerability recorded for nostr-relay-pool →
FAQ
The vulnerability involves the processing of unverified relay events, allowing malicious relays to send forged events that could be treated as authentic.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your Cargo.lock file for vulnerabilities.
The main consequence is the compromise of event integrity, which could lead to unauthorized actions being taken based on unverified events.
No, this vulnerability does not expose private keys or allow attackers to produce valid signatures for altered events.
While there are no specific workarounds, it is crucial to prioritize updating to the patched version to mitigate the risk associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for nostr-relay-pool.
