{"id":"RUSTSEC-2026-0232","aliases":[],"status":"published","title":"Processing of unverified relay events","description":"The processed events received from a relay through admission-policy and database\npaths before verifying that the serialized fields matched the claimed event ID and\nsignature. In particular, a database result for the claimed ID could cause\nverification to be skipped. The verification cache also keyed successful checks by a\n64-bit hash instead of the complete event ID.\n\nA malicious relay could send an event whose claimed ID referred to a known database\nentry while its content, tags, author, or signature differed from that ID. The forged\nevent could then reach policy callbacks or other SDK processing as if it were\nauthentic. A cache-key collision provided a second path for an unverified event to be\ntreated as previously verified. This undermines event integrity but does not reveal\nprivate keys or enable the attacker to produce a valid signature for the altered\nevent.\n\nThe SDK now verifies each event before policy evaluation, database lookup, or\npropagation decisions, and the verification cache stores the complete `EventId` so a\ntruncated hash collision cannot stand in for successful verification.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-08-01T12:00:00Z","modified":"2026-08-02T18:00:03Z","fixes":[{"ecosystem":"crates.io","package":"nostr-relay-pool","fixed_in":["0.44.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"nostr-relay-pool","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.44.3"}]}]}],"references":[{"url":"https://crates.io/crates/nostr-relay-pool","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0232.html","tags":["advisory"]},{"url":"https://github.com/nostrdevkit/nostr/commit/4b67f9b45909d2e35f34c30c084c0ab66e599a9f","tags":["web"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0232","title":"Processing of unverified relay events","description":"The processed events received from a relay through admission-policy and database\npaths before verifying that the serialized fields matched the claimed event ID and\nsignature. In particular, a database result for the claimed ID could cause\nverification to be skipped. The verification cache also keyed successful checks by a\n64-bit hash instead of the complete event ID.\n\nA malicious relay could send an event whose claimed ID referred to a known database\nentry while its content, tags, author, or signature differed from that ID. The forged\nevent could then reach policy callbacks or other SDK processing as if it were\nauthentic. A cache-key collision provided a second path for an unverified event to be\ntreated as previously verified. This undermines event integrity but does not reveal\nprivate keys or enable the attacker to produce a valid signature for the altered\nevent.\n\nThe SDK now verifies each event before policy evaluation, database lookup, or\npropagation decisions, and the verification cache stores the complete `EventId` so a\ntruncated hash collision cannot stand in for successful verification.","status":"published","published":"2026-08-01T12:00:00Z","modified":"2026-08-02T18:00:03.537985007Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:40.430679Z"}]}}