Skip to content
Fencer Intel
medium 5.5

RUSTSEC-2026-0225 json

Debug output exposes NIP-46 and NIP-60 credentials

published 3mo ago modified 3mo ago

cvss
5.5
version 3.1, OSV
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

Several NIP-46 and NIP-60 types used derived `Debug` implementations even though their fields contained credentials or decrypted application data. Formatting these values exposed NIP-46 connection secrets and request parameters, as well as NIP-60 private keys, Cashu bearer proofs, and quote capability identifiers.

Applications commonly include `Debug` output in diagnostic logs, tracing spans, or error reports. Anyone able to read those outputs could recover the disclosed credentials and, depending on the value, impersonate a signer connection or spend wallet tokens. The issue does not expose data unless an affected value is formatted and the resulting output is made accessible.

The affected types now use custom `Debug` implementations that preserve variant and non-sensitive structural information while replacing credentials, bearer values, and plaintext fields with redaction markers. Serialization and protocol behavior are unchanged.

Patch / fix

  • crates.io nostr 0.44.7

Is RUSTSEC-2026-0225 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by version score vector
OSV 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
crates.io nostr
>=0.0.0-0, <0.44.7
0.44.7

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.