---
id: RUSTSEC-2026-0231
title: Relay authentication challenges can exhaust memory
summary: Relay authentication challenges can exhaust memory
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: nostr-relay-pool
product: nostr-relay-pool
ecosystem: rust
affected:
  - 'nostr-relay-pool >= 0.0.0-0, < 0.44.3'
patched:
  - nostr-relay-pool 0.44.3
published: '2026-08-01'
updated: '2026-08-02'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0231'
references:
  - url: 'https://crates.io/crates/nostr-relay-pool'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0231.html'
  - url: >-
      https://github.com/nostrdevkit/nostr/commit/6eb8766caa25f03803f178861be054f3bca718d7
tags:
  - osv
  - rust
ingestedAt: '2026-08-02T19:11:12.957Z'
---

## Overview

The SDK forwarded every NIP-42 `AUTH` challenge received from a relay through an
unbounded command queue. Challenge handling can wait for an asynchronous signer or
user interaction, so receiving challenges was substantially faster than completing
the corresponding authentication work.

A malicious relay could continuously send new challenges without authenticating or
delivering valid events. Every value remained queued, causing memory use and pending
signer operations to grow without a fixed limit until the client became unavailable.
The issue does not allow the relay to forge a signature or learn the client's private
key.

The SDK now coalesces pending challenges through a latest-value channel. NIP-42 makes
an earlier challenge invalid when the relay sends a new one, so replacing pending
work preserves the only challenge that can still be answered while keeping memory
use bounded.

## Affected packages

- `nostr-relay-pool >= 0.0.0-0, < 0.44.3`

## Remediation

Upgrade to a patched release:

- `nostr-relay-pool 0.44.3`