{"id":"RUSTSEC-2026-0225","title":"Debug output exposes NIP-46 and NIP-60 credentials","summary":"Debug output exposes NIP-46 and NIP-60 credentials","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","vendor":"nostr","product":"nostr","ecosystem":"rust","affected":["nostr >= 0.0.0-0, < 0.44.7"],"patched":["nostr 0.44.7"],"published":"2026-08-01","updated":"2026-08-02","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0225","references":[{"url":"https://crates.io/crates/nostr"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0225.html"},{"url":"https://github.com/nostrdevkit/nostr/commit/2bc5fa2c270bb87b397d381909053f12ee734d44"},{"url":"https://github.com/nostrdevkit/nostr/commit/778af7e4930449dcdd7a070774da7b71b282d171"}],"tags":["osv","rust"],"ingestedAt":"2026-08-02T19:11:12.784Z","slug":"RUSTSEC-2026-0225","body":"## Overview\n\nSeveral NIP-46 and NIP-60 types used derived `Debug` implementations even though\ntheir fields contained credentials or decrypted application data. Formatting these\nvalues exposed NIP-46 connection secrets and request parameters, as well as NIP-60\nprivate keys, Cashu bearer proofs, and quote capability identifiers.\n\nApplications commonly include `Debug` output in diagnostic logs, tracing spans, or\nerror reports. Anyone able to read those outputs could recover the disclosed\ncredentials and, depending on the value, impersonate a signer connection or spend\nwallet tokens. The issue does not expose data unless an affected value is formatted\nand the resulting output is made accessible.\n\nThe affected types now use custom `Debug` implementations that preserve variant and\nnon-sensitive structural information while replacing credentials, bearer values,\nand plaintext fields with redaction markers. Serialization and protocol behavior are\nunchanged.\n\n## Affected packages\n\n- `nostr >= 0.0.0-0, < 0.44.7`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `nostr 0.44.7`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}