Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
The nostr crate on crates.io, versions before 0.44.7, is vulnerable. Its NIP-44 decryption decodes an entire attacker-supplied payload and runs HMAC on oversized v2 payloads before checking size limits. A malicious relay or event author can send such oversized values to an application that decrypts NIP-44 content, without knowing the conversation key, which can exhaust memory or CPU and make the application unavailable. Upgrade to nostr 0.44.7, which rejects oversized payloads before allocation or HMAC processing.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 7.5 | High | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | OSV |
- CISA KEV Not listed.
- EPSS No score.
Timeline
- 31 Oct 2026, 15:18 UTC First seen by agentprime
- 31 Oct 2026, 15:18 UTC Confirmed by OSV