Security

Report a vulnerability

SECURITY.md

Reporting a Vulnerability

For security vulnerability reporting and our complete security policy, please see: https://github.com/nostrdevkit/guidelines

Wallet event parsers accept unauthenticated events
GHSA-v2xx-q3jc-2r8w published Aug 2, 2026 by yukibtc

High
NIP-98 authorization parsing permits resource exhaustion
GHSA-f89m-394c-jfpm published Aug 2, 2026 by yukibtc

High
Empty NIP-50 search filters can panic
GHSA-739m-c885-58rq published Aug 2, 2026 by yukibtc

High
NIP-44 v2 decryption permits resource exhaustion
GHSA-9p75-m8cr-4h25 published Aug 2, 2026 by yukibtc

High
NIP-04 parsing amplifies malformed ciphertext memory use
GHSA-cjpx-rp36-fj8r published Aug 2, 2026 by yukibtc

Moderate
Debug output exposes NIP-46 and NIP-60 credentials
GHSA-j4ff-259j-7qjp published Aug 2, 2026 by yukibtc

Moderate
Relay authentication challenges can exhaust memory
GHSA-hwqm-xw2q-5hmc published Aug 2, 2026 by yukibtc

High
Processing of unverified relay events
GHSA-7863-gx29-2chr published Aug 2, 2026 by yukibtc

High
Verification cache poisoning allows forged Nostr events to bypass signature validation
GHSA-f96q-5f6p-v7cj published Aug 1, 2026 by yukibtc

High
Remote Denial of Service via malformed NIP-04 IV
GHSA-xg7c-246g-6qpv published Jul 26, 2026 by yukibtc

High

Learn more about advisories related to nostrdevkit/nostr in the GitHub Advisory Database