AIKIDO-2026-783590

nostr is vulnerable to Improper Verification of Data Authenticity

GHSA-v2xx-q3jc-2r8wPublished Aug 5, 2026

CVE Score

High

Improper Verification of Data Authenticity

TL;DR

The NIP-47 response and notification parsers and the NIP-60 wallet event parsers decrypt relay-provided events before verifying the event kind, computed id, signature, and expected wallet public key. Because the decryption peer is derived from the untrusted event author, successful decryption does not prove the configured wallet produced the event. A malicious relay can deliver an attacker-signed event that is parsed as a genuine wallet response, notification, token, spending record, or quote, corrupting wallet state or driving the application to act on forged data. The fix verifies the event kind, id, signature, and exact configured wallet author before decrypting or parsing the plaintext.

How do I fix this?

Upgrade the nostr library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application parses NIP-47 wallet-connect or NIP-60 wallet events received from relays.