AIKIDO-2026-454229
nostr is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
nostrTL;DR
The legacy NIP-04 decryption routine in the nostr crate parses the initialization vector from the base64 ?iv= portion of untrusted message content. It converts the decoded bytes directly into a fixed 16-byte AES-CBC IV without checking the decoded length. When a Kind-4 encrypted message carries an IV whose decoded length is not 16 bytes, the conversion panics and crashes the decrypting task or process. The fix validates the decoded IV length (try_into to [u8; 16]) and returns an InvalidIVLen error instead of panicking.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application decrypts NIP-04 (legacy Kind-4 encrypted direct message) content from untrusted senders.
Background info
nostr is vulnerable to Denial of Service (DoS) in versions 0.1.5 - 0.44.5.
How to fix this
Upgrade the nostr library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant