{"id":"RUSTSEC-2026-0225","aliases":[],"status":"published","title":"Debug output exposes NIP-46 and NIP-60 credentials","description":"Several NIP-46 and NIP-60 types used derived `Debug` implementations even though\ntheir fields contained credentials or decrypted application data. Formatting these\nvalues exposed NIP-46 connection secrets and request parameters, as well as NIP-60\nprivate keys, Cashu bearer proofs, and quote capability identifiers.\n\nApplications commonly include `Debug` output in diagnostic logs, tracing spans, or\nerror reports. Anyone able to read those outputs could recover the disclosed\ncredentials and, depending on the value, impersonate a signer connection or spend\nwallet tokens. The issue does not expose data unless an affected value is formatted\nand the resulting output is made accessible.\n\nThe affected types now use custom `Debug` implementations that preserve variant and\nnon-sensitive structural information while replacing credentials, bearer values,\nand plaintext fields with redaction markers. Serialization and protocol behavior are\nunchanged.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-08-01T12:00:00Z","modified":"2026-08-02T18:00:03Z","fixes":[{"ecosystem":"crates.io","package":"nostr","fixed_in":["0.44.7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"nostr","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.44.7"}]}]}],"references":[{"url":"https://crates.io/crates/nostr","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0225.html","tags":["advisory"]},{"url":"https://github.com/nostrdevkit/nostr/commit/2bc5fa2c270bb87b397d381909053f12ee734d44","tags":["web"]},{"url":"https://github.com/nostrdevkit/nostr/commit/778af7e4930449dcdd7a070774da7b71b282d171","tags":["web"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0225","title":"Debug output exposes NIP-46 and NIP-60 credentials","description":"Several NIP-46 and NIP-60 types used derived `Debug` implementations even though\ntheir fields contained credentials or decrypted application data. Formatting these\nvalues exposed NIP-46 connection secrets and request parameters, as well as NIP-60\nprivate keys, Cashu bearer proofs, and quote capability identifiers.\n\nApplications commonly include `Debug` output in diagnostic logs, tracing spans, or\nerror reports. Anyone able to read those outputs could recover the disclosed\ncredentials and, depending on the value, impersonate a signer connection or spend\nwallet tokens. The issue does not expose data unless an affected value is formatted\nand the resulting output is made accessible.\n\nThe affected types now use custom `Debug` implementations that preserve variant and\nnon-sensitive structural information while replacing credentials, bearer values,\nand plaintext fields with redaction markers. Serialization and protocol behavior are\nunchanged.","status":"published","published":"2026-08-01T12:00:00Z","modified":"2026-08-02T18:00:03.539675919Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:40.430679Z"}]}}