{"id":"RUSTSEC-2026-0219","title":"Remote Denial of Service via malformed NIP-04 IV","summary":"Remote Denial of Service via malformed NIP-04 IV","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"nostr","product":"nostr","ecosystem":"rust","affected":["nostr >= 0.45.0-alpha.1, < 0.45.0-alpha.6"],"patched":["nostr 0.45.0-alpha.6"],"published":"2026-07-26","updated":"2026-07-29","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0219","references":[{"url":"https://crates.io/crates/nostr"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0219.html"},{"url":"https://github.com/nostrdevkit/nostr/commit/b24619346f666d08ef7fefe27f033b8bc871697f"}],"tags":["osv","rust"],"ingestedAt":"2026-07-29T19:09:38.057Z","slug":"RUSTSEC-2026-0219","body":"## Overview\n\nThe `nostr` crate did not validate the length of the initialization vector\ndecoded from the `?iv=` portion of a NIP-04 encrypted message.\n\nThe decoded IV was converted from a byte slice to the 16-byte AES-CBC IV type\nusing a conversion that asserts the slice length. As a result, an IV whose\ndecoded length was not exactly 16 bytes caused a panic before ciphertext\ndecryption. For example, `?iv=AAAA` decodes to a three-byte IV and triggers the\npanic.\n\nApplications that decrypt untrusted NIP-04 content are affected. The issue is\nalso reachable through NIP-47 (Nostr Wallet Connect), where response and\nnotification events from a malicious or compromised wallet service are passed\nto NIP-04 decryption. If the panic is not isolated, a crafted event can terminate\nthe application or disrupt message processing, causing a denial of service.\n\nThe issue does not affect confidentiality or integrity.\n\nThe flaw was corrected by converting the decoded IV to `[u8; 16]` using a\nchecked conversion. Invalid IV lengths now return a `Malformed` error instead of\npanicking.\n\n## Credit\n\nDiscovered and responsibly disclosed by **Muhammed Shekho** ([mhd-shekho.com](https://mhd-shekho.com)).\n\n## Affected packages\n\n- `nostr >= 0.45.0-alpha.1, < 0.45.0-alpha.6`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `nostr 0.45.0-alpha.6`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}