RUSTSEC-2026-0230 Empty NIP-50 search filters can panic
Remote attackers can cause denial of service by submitting empty NIP-50 search filters, triggering a panic in the Rust event-matching library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is RUSTSEC-2026-0230?
RUSTSEC-2026-0230 is a denial of service vulnerability in nostr, published on 1 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The NIP-50 event-matching path searched event content with
slice::windows(search.len()). An empty search string therefore called
slice::windows(0), which always panics instead of returning a match result.
A remote client able to submit filters to an application using this matcher could trigger the panic with an empty NIP-50 search value. This includes clients querying an SDK local relay. Depending on the application's panic configuration and task isolation, the crafted filter could terminate request processing, a runtime worker, or the entire process, causing denial of service. No confidentiality or integrity impact is known.
Empty searches are now handled before the substring search, so the matcher returns a defined result without constructing a zero-sized window or panicking.
Which versions are affected by RUSTSEC-2026-0230?
1 open source package ship an affected version, including nostr.
| Package | Affected | Fixed in |
|---|---|---|
nostr crates.io | From 0.0.0-0 | 0.44.7 |
How do I fix RUSTSEC-2026-0230?
Upgrade nostr to 0.44.7 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is RUSTSEC-2026-0230 being exploited?
There is no known exploitation of RUSTSEC-2026-0230 in the wild and no public exploit code.