Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
The nostr crate, versions before 0.44.7, has wallet event parsers for NIP-47 responses and notifications and for NIP-60 wallet events that decrypt events before checking their author. A malicious relay can deliver an event signed by an attacker, so forged wallet responses, notifications, tokens, spending records, or quotes get accepted as coming from the configured wallet. This can corrupt wallet state or make an application act on forged data. Upgrade to nostr 0.44.7 or later.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 7.5 | High | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | OSV |
- CISA KEV Not listed.
- EPSS No score.
Timeline
- 31 Oct 2026, 15:18 UTC First seen by agentprime
- 31 Oct 2026, 15:18 UTC Confirmed by OSV