rustsec-2026-0225
Vulnerability from osv_rustsec
Several NIP-46 and NIP-60 types used derived Debug implementations even though
their fields contained credentials or decrypted application data. Formatting these
values exposed NIP-46 connection secrets and request parameters, as well as NIP-60
private keys, Cashu bearer proofs, and quote capability identifiers.
Applications commonly include Debug output in diagnostic logs, tracing spans, or
error reports. Anyone able to read those outputs could recover the disclosed
credentials and, depending on the value, impersonate a signer connection or spend
wallet tokens. The issue does not expose data unless an affected value is formatted
and the resulting output is made accessible.
The affected types now use custom Debug implementations that preserve variant and
non-sensitive structural information while replacing credentials, bearer values,
and plaintext fields with redaction markers. Serialization and protocol behavior are
unchanged.
{
"affected": [
{
"database_specific": {
"categories": [
"file-disclosure"
],
"cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"informational": null
},
"ecosystem_specific": {
"affected_functions": null,
"affects": {
"arch": [],
"functions": [],
"os": []
}
},
"package": {
"ecosystem": "crates.io",
"name": "nostr",
"purl": "pkg:cargo/nostr"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0-0"
},
{
"fixed": "0.44.7"
}
],
"type": "SEMVER"
}
],
"versions": []
}
],
"aliases": [],
"database_specific": {
"license": "CC0-1.0"
},
"details": "Several NIP-46 and NIP-60 types used derived `Debug` implementations even though\ntheir fields contained credentials or decrypted application data. Formatting these\nvalues exposed NIP-46 connection secrets and request parameters, as well as NIP-60\nprivate keys, Cashu bearer proofs, and quote capability identifiers.\n\nApplications commonly include `Debug` output in diagnostic logs, tracing spans, or\nerror reports. Anyone able to read those outputs could recover the disclosed\ncredentials and, depending on the value, impersonate a signer connection or spend\nwallet tokens. The issue does not expose data unless an affected value is formatted\nand the resulting output is made accessible.\n\nThe affected types now use custom `Debug` implementations that preserve variant and\nnon-sensitive structural information while replacing credentials, bearer values,\nand plaintext fields with redaction markers. Serialization and protocol behavior are\nunchanged.",
"id": "RUSTSEC-2026-0225",
"modified": "2026-08-02T17:56:20Z",
"published": "2026-08-01T12:00:00Z",
"references": [
{
"type": "PACKAGE",
"url": "https://crates.io/crates/nostr"
},
{
"type": "ADVISORY",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0225.html"
},
{
"type": "WEB",
"url": "https://github.com/nostrdevkit/nostr/commit/2bc5fa2c270bb87b397d381909053f12ee734d44"
},
{
"type": "WEB",
"url": "https://github.com/nostrdevkit/nostr/commit/778af7e4930449dcdd7a070774da7b71b282d171"
}
],
"related": [],
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Debug output exposes NIP-46 and NIP-60 credentials"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.