Intel

AIKIDO-2026-113068

Nostr.Sdk is vulnerable to Denial of Service

GHSA-739m-c885-58rqPublished Aug 5, 2026
August 5, 2026

75

CVE Score

High

Denial of Service

Are you affected? Scan for Free

TL;DR

The NIP-50 event-matching path searches event content using a sliding window sized from the search string length. An empty search string produces a zero-sized window, which always panics instead of returning a result. Filters carrying an empty search value therefore terminate the process rather than raising a catchable error, and the value can reach that path through direct filter matching, the bundled local relay, or in-memory database queries. The fix handles empty searches before the substring search so the matcher returns a defined result without panicking.

How do I fix this?

Upgrade the Nostr.Sdk library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application matches NIP-50 search filters supplied by remote clients through direct filter matching, the bundled local relay, or in-memory database queries.

Package

Versions

0.40.0 - 0.44.7

Fixed in 0.44.8

Background info

Nostr.Sdk is vulnerable to Denial of Service in versions 0.40.0 - 0.44.7.

Get secure today,
quickly and for free.

Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.

No credit card required | Scan results in 32 seconds.

Trusted by 150k+ orgs
  • Revolut
  • n8n
  • Lovable
  • Deel
  • Prove
  • Omnea