---
id: RUSTSEC-2026-0225
title: Debug output exposes NIP-46 and NIP-60 credentials
summary: Debug output exposes NIP-46 and NIP-60 credentials
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
vendor: nostr
product: nostr
ecosystem: rust
affected:
  - 'nostr >= 0.0.0-0, < 0.44.7'
patched:
  - nostr 0.44.7
published: '2026-08-01'
updated: '2026-08-02'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0225'
references:
  - url: 'https://crates.io/crates/nostr'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0225.html'
  - url: >-
      https://github.com/nostrdevkit/nostr/commit/2bc5fa2c270bb87b397d381909053f12ee734d44
  - url: >-
      https://github.com/nostrdevkit/nostr/commit/778af7e4930449dcdd7a070774da7b71b282d171
tags:
  - osv
  - rust
ingestedAt: '2026-08-02T19:11:12.784Z'
---

## Overview

Several NIP-46 and NIP-60 types used derived `Debug` implementations even though
their fields contained credentials or decrypted application data. Formatting these
values exposed NIP-46 connection secrets and request parameters, as well as NIP-60
private keys, Cashu bearer proofs, and quote capability identifiers.

Applications commonly include `Debug` output in diagnostic logs, tracing spans, or
error reports. Anyone able to read those outputs could recover the disclosed
credentials and, depending on the value, impersonate a signer connection or spend
wallet tokens. The issue does not expose data unless an affected value is formatted
and the resulting output is made accessible.

The affected types now use custom `Debug` implementations that preserve variant and
non-sensitive structural information while replacing credentials, bearer values,
and plaintext fields with redaction markers. Serialization and protocol behavior are
unchanged.

## Affected packages

- `nostr >= 0.0.0-0, < 0.44.7`

## Remediation

Upgrade to a patched release:

- `nostr 0.44.7`