AIKIDO-2026-847033
nostr is vulnerable to Uncontrolled Resource Consumption
75
CVE Score
High
Uncontrolled Resource Consumption
TL;DR
The NIP-98 HTTP authorization parser Base64-decodes the entire authorization value and parses the resulting JSON event without an application-level size limit, and before the event signature and authorization fields are validated. An unauthenticated remote client can send an oversized Authorization: Nostr header, causing memory allocation and decoding and JSON parsing work proportional to the input on every request. Repeated requests consume server memory and CPU and can make the service unavailable. The fix rejects oversized encoded input before allocation and rejects decoded authorization events larger than 64 KiB before JSON parsing.
How do I fix this?
Upgrade the nostr library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application uses the NIP-98 HTTP authorization parser on untrusted input.
Package
Versions
0.0.1 - 0.44.6
Fixed in 0.44.7Background info
nostr is vulnerable to Uncontrolled Resource Consumption in versions 0.0.1 - 0.44.6.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.