RUSTSEC-2026-0225

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0225

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0225.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0225

Published

2026-08-01T12:00:00Z

Modified

2026-08-02T18:00:03.539675919Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Debug output exposes NIP-46 and NIP-60 credentials

Details

Several NIP-46 and NIP-60 types used derived Debug implementations even though their fields contained credentials or decrypted application data. Formatting these values exposed NIP-46 connection secrets and request parameters, as well as NIP-60 private keys, Cashu bearer proofs, and quote capability identifiers.

Applications commonly include Debug output in diagnostic logs, tracing spans, or error reports. Anyone able to read those outputs could recover the disclosed credentials and, depending on the value, impersonate a signer connection or spend wallet tokens. The issue does not expose data unless an affected value is formatted and the resulting output is made accessible.

The affected types now use custom Debug implementations that preserve variant and non-sensitive structural information while replacing credentials, bearer values, and plaintext fields with redaction markers. Serialization and protocol behavior are unchanged.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / nostr

Package

Name: nostr; View open source insights on deps.dev
Purl: pkg:cargo/nostr

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.44.7

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}