AIKIDO-2026-847033
nostr is vulnerable to Uncontrolled Resource Consumption
75
High Risk
This Affects:
nostrTL;DR
The NIP-98 HTTP authorization parser Base64-decodes the entire authorization value and parses the resulting JSON event without an application-level size limit, and before the event signature and authorization fields are validated. An unauthenticated remote client can send an oversized Authorization: Nostr header, causing memory allocation and decoding and JSON parsing work proportional to the input on every request. Repeated requests consume server memory and CPU and can make the service unavailable. The fix rejects oversized encoded input before allocation and rejects decoded authorization events larger than 64 KiB before JSON parsing.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application uses the NIP-98 HTTP authorization parser on untrusted input.
Background info
nostr is vulnerable to Uncontrolled Resource Consumption in versions 0.0.1 - 0.44.6.
How to fix this
Upgrade the nostr library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant