AIKIDO-2026-776907

nostr-sdk is vulnerable to Improper Verification of Data Authenticity

GHSA-v2xx-q3jc-2r8wPublished Aug 5, 2026

CVE Score

High

Improper Verification of Data Authenticity

TL;DR

The NIP-47 wallet-connect response parser decrypts relay-provided events before verifying the event kind, computed id, signature, and expected wallet public key. Because the decryption peer is derived from the untrusted event author, successful decryption does not prove the configured wallet produced the event. A relay can deliver an event signed by a different key that is then parsed as a genuine wallet response, corrupting wallet state or driving the application to act on forged data. The fix verifies the event kind, id, signature, and exact configured wallet author before decrypting or parsing the plaintext.

How do I fix this?

Upgrade the nostr-sdk library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application uses the Nostr Wallet Connect (NIP-47) client to send wallet requests and parse responses received from relays.