AIKIDO-2026-783590

nostr is vulnerable to Improper Verification of Data Authenticity

Improper Verification of Data AuthenticityGHSA-v2xx-q3jc-2r8w Published 2 days ago

High Risk

This Affects:

nostr

0.0.1 - 0.44.6

Fixed in 0.44.7

Are you affected? Scan for Free

TL;DR

The NIP-47 response and notification parsers and the NIP-60 wallet event parsers decrypt relay-provided events before verifying the event kind, computed id, signature, and expected wallet public key. Because the decryption peer is derived from the untrusted event author, successful decryption does not prove the configured wallet produced the event. A malicious relay can deliver an attacker-signed event that is parsed as a genuine wallet response, notification, token, spending record, or quote, corrupting wallet state or driving the application to act on forged data. The fix verifies the event kind, id, signature, and exact configured wallet author before decrypting or parsing the plaintext.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application parses NIP-47 wallet-connect or NIP-60 wallet events received from relays.