AIKIDO-2026-444309
nostr is vulnerable to Insertion of Sensitive Information into Log File
55
CVE Score
Medium
Insertion of Sensitive Information into Log File
TL;DR
Several NIP-46 and NIP-60 types derive their Debug implementations even though their fields hold credentials or decrypted application data. Formatting these values exposes NIP-46 connection secrets and request parameters as well as NIP-60 private keys, Cashu bearer proofs, and quote capability identifiers. Because applications commonly place Debug output in logs, tracing spans, or error reports, anyone able to read those outputs can recover the credentials and impersonate a signer connection or spend wallet tokens. The fix replaces the derived implementations with custom Debug output that redacts credentials, bearer values, and plaintext fields while preserving non-sensitive structure.
How do I fix this?
Upgrade the nostr library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application includes Debug output of NIP-46 or NIP-60 types in logs, tracing, or error reports.
Package
Versions
0.0.1 - 0.44.6
Fixed in 0.44.7Background info
nostr is vulnerable to Insertion of Sensitive Information into Log File in versions 0.0.1 - 0.44.6.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.