Intel

AIKIDO-2026-123864

nostr-sdk is vulnerable to Denial of Service

Denial of ServiceGHSA-739m-c885-58rq Published Aug 5, 2026

75

High Risk

This Affects:

SWIFTnostr-sdk
0.0.1 - 0.44.7
Fixed in 0.44.8
Are you affected? Scan for Free

TL;DR

The NIP-50 event-matching path searches event content using a sliding window sized from the search string length. An empty search string produces a zero-sized window, which always panics instead of returning a result. Filters carrying an empty search value therefore terminate the process rather than raising a catchable error, and the value can reach that path through direct filter matching, the bundled local relay, or in-memory database queries. The fix handles empty searches before the substring search so the matcher returns a defined result without panicking.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application matches NIP-50 search filters supplied by remote clients through direct filter matching, the bundled local relay, or in-memory database queries.

Background info

nostr-sdk is vulnerable to Denial of Service in versions 0.0.1 - 0.44.7.

How to fix this

Upgrade the nostr-sdk library to the patch version.

Are You Affected?

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Free. No credit card required.

Aikido Platform