{"id":"RUSTSEC-2026-0232","title":"Processing of unverified relay events","summary":"Processing of unverified relay events","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","vendor":"nostr-relay-pool","product":"nostr-relay-pool","ecosystem":"rust","affected":["nostr-relay-pool >= 0.0.0-0, < 0.44.3"],"patched":["nostr-relay-pool 0.44.3"],"published":"2026-08-01","updated":"2026-08-02","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0232","references":[{"url":"https://crates.io/crates/nostr-relay-pool"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0232.html"},{"url":"https://github.com/nostrdevkit/nostr/commit/4b67f9b45909d2e35f34c30c084c0ab66e599a9f"}],"tags":["osv","rust"],"ingestedAt":"2026-08-02T19:11:12.987Z","slug":"RUSTSEC-2026-0232","body":"## Overview\n\nThe processed events received from a relay through admission-policy and database\npaths before verifying that the serialized fields matched the claimed event ID and\nsignature. In particular, a database result for the claimed ID could cause\nverification to be skipped. The verification cache also keyed successful checks by a\n64-bit hash instead of the complete event ID.\n\nA malicious relay could send an event whose claimed ID referred to a known database\nentry while its content, tags, author, or signature differed from that ID. The forged\nevent could then reach policy callbacks or other SDK processing as if it were\nauthentic. A cache-key collision provided a second path for an unverified event to be\ntreated as previously verified. This undermines event integrity but does not reveal\nprivate keys or enable the attacker to produce a valid signature for the altered\nevent.\n\nThe SDK now verifies each event before policy evaluation, database lookup, or\npropagation decisions, and the verification cache stores the complete `EventId` so a\ntruncated hash collision cannot stand in for successful verification.\n\n## Affected packages\n\n- `nostr-relay-pool >= 0.0.0-0, < 0.44.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `nostr-relay-pool 0.44.3`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}