CVE-2026-54542 Nimiq: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserialized proof

What is CVE-2026-54542?

CVE-2026-54542 is a low-severity denial of service vulnerability in nimiq core-rs-albatross, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk whose proof contains a TrieNodeChild suffix that is individually valid but exceeds the 63-byte KeyNibbles backing array when combined with the parent key. KeyNibbles::Add in primitives/src/key_nibbles.rs performs the combined slice operation without checking the total length, and the input reaches put_chunk, TrieNodeChild::key, and TrieNodeChild::is_stump before proof.verify, so the attacker does not need a valid cryptographic proof. Exploitation requires the attacker to be selected as the victim's sync peer during state sync. The resulting out-of-bounds panic is transient because the node restarts and resynchronizes. This issue is fixed in version 1.6.0.

Weakness: CWE-125

Which versions are affected by CVE-2026-54542?

2 open source packages ship an affected version, including nimiq-primitives.

How do I fix CVE-2026-54542?

Upgrade nimiq-primitives to 1.6.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-54542 being exploited?

There is no known exploitation of CVE-2026-54542 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5rg2-xv9j-gv5p.