CVE-2026-54541 Nimiq: Panic in TrieProof::verify via child_index unwrap on equal-length keys
A malicious peer can crash a syncing Nimiq node by sending crafted trie proofs, causing a panic via an unwrap on equal-length keys.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54541?
CVE-2026-54541 is a low-severity denial of service vulnerability in nimiq core-rs-albatross, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk proof containing two TrieProofNode values with identical keys. TrieProof::verify calls TrieProofNode::child_index in primitives/src/trie/trie_proof_node.rs, where is_prefix_of accepts equal keys and KeyNibbles::get is called at the key length, returns None, and is unconditionally unwrapped. Untrusted ResponseChunk data reaches commit_chunks, put_chunk, and proof.verify before cryptographic proof validation, so the attacker does not need a valid proof. Exploitation requires the attacker to be selected as the victim's sync peer during state sync, and the resulting panic is transient because the node restarts and resynchronizes. This issue is fixed in version 1.6.0.
Weakness: CWE-248
Which versions are affected by CVE-2026-54541?
2 open source packages ship an affected version, including nimiq-primitives.
| Package | Affected | Fixed in |
|---|---|---|
nimiq-primitives crates.io | All versions | 1.6.0 |
nimiq-primitives crates.io | All versions | 1.6.0 |
How do I fix CVE-2026-54541?
Upgrade nimiq-primitives to 1.6.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-54541 being exploited?
There is no known exploitation of CVE-2026-54541 in the wild and no public exploit code.
Sources
Also known as GHSA-46wq-28cx-mhw4.