nostr-sdk is vulnerable to Denial of Service
75
CVE Score
High
Denial of Service
The NIP-50 event-matching path searches event content using a sliding window sized from the search string length. An empty search string produces a zero-sized window, which always panics instead of returning a result. Filters carrying an empty search value therefore terminate the process rather than raising a catchable error, and the value can reach that path through direct filter matching, the bundled local relay, or in-memory database queries. The fix handles empty searches before the substring search so the matcher returns a defined result without panicking.
Upgrade the nostr-sdk library to the patch version.
You are affected if you are using a version that falls within the vulnerable range and your application matches NIP-50 search filters supplied by remote clients through direct filter matching, the bundled local relay, or in-memory database queries.
0.0.1 - 0.44.7
Fixed in 0.44.8nostr-sdk is vulnerable to Denial of Service in versions 0.0.1 - 0.44.7.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.