AIKIDO-2026-611773

TL;DR

The NIP-44 v2 decryption path in the nostr crate reads a two-byte padding-length prefix from the decrypted buffer without first checking that the payload and decrypted buffer are large enough. A sender who shares the conversation key, including anyone who crafts a gift-wrapped event addressed to the victim's public key, can produce a short payload with a valid HMAC whose decrypted buffer holds zero or one byte. When decrypt or decrypt_to_bytes processes such a payload it performs an out-of-bounds slice access and panics, aborting the operation and potentially crashing the client that decrypts the event. The fix rejects payloads below the minimum NIP-44 v2 size and replaces the unchecked slice indexing with bounds-checked reads.