AIKIDO-2026-444309
nostr is vulnerable to Insertion of Sensitive Information into Log File
55
Medium Risk
This Affects:
nostrTL;DR
Several NIP-46 and NIP-60 types derive their Debug implementations even though their fields hold credentials or decrypted application data. Formatting these values exposes NIP-46 connection secrets and request parameters as well as NIP-60 private keys, Cashu bearer proofs, and quote capability identifiers. Because applications commonly place Debug output in logs, tracing spans, or error reports, anyone able to read those outputs can recover the credentials and impersonate a signer connection or spend wallet tokens. The fix replaces the derived implementations with custom Debug output that redacts credentials, bearer values, and plaintext fields while preserving non-sensitive structure.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application includes Debug output of NIP-46 or NIP-60 types in logs, tracing, or error reports.
Background info
nostr is vulnerable to Insertion of Sensitive Information into Log File in versions 0.0.1 - 0.44.6.
How to fix this
Upgrade the nostr library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant