Nostr.Sdk is vulnerable to Denial of Service
75
High Risk
The NIP-50 event-matching path searches event content using a sliding window sized from the search string length. An empty search string produces a zero-sized window, which always panics instead of returning a result. Filters carrying an empty search value therefore terminate the process rather than raising a catchable error, and the value can reach that path through direct filter matching, the bundled local relay, or in-memory database queries. The fix handles empty searches before the substring search so the matcher returns a defined result without panicking.
You are affected if you are using a version that falls within the vulnerable range and your application matches NIP-50 search filters supplied by remote clients through direct filter matching, the bundled local relay, or in-memory database queries.
Nostr.Sdk is vulnerable to Denial of Service in versions 0.40.0 - 0.44.7.
Upgrade the Nostr.Sdk library to the patch version.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant