RUSTSEC-2026-0226 Wallet event parsers accept unauthenticated events
Attackers can forge wallet events via malicious relays, causing applications to process fake data and corrupt wallet state.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is RUSTSEC-2026-0226?
RUSTSEC-2026-0226 is a missing authorization vulnerability in nostr, published on 1 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The NIP-47 response and notification parsers and the NIP-60 wallet event parsers decrypted relay-provided events before verifying their kind, computed event ID, signature, and expected wallet public key. The decryption peer was derived from the untrusted event author, so successful decryption did not prove that the configured wallet created the event.
An attacker can sign an event with their own key and derive the corresponding shared secret with the victim's public key. A malicious relay delivering that event could therefore cause attacker-chosen encrypted content to be parsed as a response, notification, token, spending record, or quote from the configured wallet. This can corrupt wallet state or cause an application to act on forged wallet data. The issue does not expose the victim's private key or decrypt events authored by the legitimate wallet.
The affected parsers now verify the event kind, ID, signature, and exact configured wallet author before attempting decryption or parsing the plaintext.
Which versions are affected by RUSTSEC-2026-0226?
1 open source package ship an affected version, including nostr.
| Package | Affected | Fixed in |
|---|---|---|
nostr crates.io | From 0.0.0-0 | 0.44.7 |
How do I fix RUSTSEC-2026-0226?
Upgrade nostr to 0.44.7 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is RUSTSEC-2026-0226 being exploited?
There is no known exploitation of RUSTSEC-2026-0226 in the wild and no public exploit code.