RUSTSEC-2026-0225 json
Debug output exposes NIP-46 and NIP-60 credentials
published 3mo ago modified 3mo ago
- cvss
- 5.5
- version 3.1, OSV
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
Several NIP-46 and NIP-60 types used derived `Debug` implementations even though their fields contained credentials or decrypted application data. Formatting these values exposed NIP-46 connection secrets and request parameters, as well as NIP-60 private keys, Cashu bearer proofs, and quote capability identifiers.
Applications commonly include `Debug` output in diagnostic logs, tracing spans, or error reports. Anyone able to read those outputs could recover the disclosed credentials and, depending on the value, impersonate a signer connection or spend wallet tokens. The issue does not expose data unless an affected value is formatted and the resulting output is made accessible.
The affected types now use custom `Debug` implementations that preserve variant and non-sensitive structural information while replacing credentials, bearer values, and plaintext fields with redaction markers. Serialization and protocol behavior are unchanged.
Patch / fix
- crates.io nostr 0.44.7
Is RUSTSEC-2026-0225 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| OSV | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | nostr | >=0.0.0-0, <0.44.7 |
0.44.7 |
References
Sources
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.