Uncaught Exception Affecting nostr package, versions >=0.26.0 <0.44.5>=0.45.0-alpha.1 <0.45.0-alpha.5
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-NOSTR-18506912
- published2 Aug 2026
- disclosed25 Jul 2026
- creditUnknown
Introduced: 25 Jul 2026
New CVE NOT AVAILABLE CWE-248 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade nostr to version 0.44.5, 0.45.0-alpha.5 or higher.
Overview
Affected versions of this package are vulnerable to Uncaught Exception via the nostr::nips::nip44::decrypt, nostr::nips::nip44::decrypt_to_bytes, or nostr::nips::nip44::v2::decrypt_to_bytes functions. An attacker can cause a panic and terminate the process by sending a crafted payload that results in a decrypted buffer shorter than 2 bytes, leading to an out-of-bounds read.