Repository navigation

Security

Report a vulnerability

SECURITY.md

Reporting a Vulnerability

For security vulnerability reporting and our complete security policy, please see: https://github.com/nostrdevkit/guidelines

nwc: wallet response not bound to the request it answers
GHSA-q8wh-f9fh-6gj9 published Nov 2, 2026 by yukibtc

Moderate
NIP-44 v2 decryption compares the HMAC without constant-time comparison
GHSA-35m7-8643-fx47 published Nov 2, 2026 by yukibtc

Low
Wallet event parsers accept unauthenticated events
GHSA-v2xx-q3jc-2r8w published Aug 2, 2026 by yukibtc

High
NIP-98 authorization parsing permits resource exhaustion
GHSA-f89m-394c-jfpm published Aug 2, 2026 by yukibtc

High
Empty NIP-50 search filters can panic
GHSA-739m-c885-58rq published Aug 2, 2026 by yukibtc

High
NIP-44 v2 decryption permits resource exhaustion
GHSA-9p75-m8cr-4h25 published Aug 2, 2026 by yukibtc

High
NIP-04 parsing amplifies malformed ciphertext memory use
GHSA-cjpx-rp36-fj8r published Aug 2, 2026 by yukibtc

Moderate
Debug output exposes NIP-46 and NIP-60 credentials
GHSA-j4ff-259j-7qjp published Aug 2, 2026 by yukibtc

Moderate
Relay authentication challenges can exhaust memory
GHSA-hwqm-xw2q-5hmc published Aug 2, 2026 by yukibtc

High
Processing of unverified relay events
GHSA-7863-gx29-2chr published Aug 2, 2026 by yukibtc

High

Learn more about advisories related to nostrdevkit/nostr in the GitHub Advisory Database