CVE-2026-54542: Nimiq nimiq-primitives out-of-bounds panic in KeyNibbles::Add

CVE-2026-54542 · Severity: low · CVSS 3.7 · Published 2026-09-14

A vulnerability in the Nimiq blockchain software allows a malicious network peer to crash a node during the synchronization process. By sending a specially crafted data chunk, an attacker can trigger an internal error that causes the syncing node to stop functioning. While the crash is temporary and the node will attempt to restart, it can disrupt operations and delay the synchronization of the blockchain state.

Technologies: nimiq-primitives (crates.io), Nimiq Core-Rs-Albatross. Vendors: crates.io, Nimiq.

Quick answers

Is CVE-2026-54542 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54542 being exploited in the wild.
How severe is CVE-2026-54542?
Low severity, with a CVSS score of 3.7, published 14 September 2026.
Which products and versions are affected?
nimiq-primitives (crates.io) < 1.6.0, SEMVER:introduced=0,fixed=1.6.0; Nimiq Core-Rs-Albatross <= 1.5.1.
Is there a fix for CVE-2026-54542?
Yes. nimiq-primitives (crates.io): upgrade to 1.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54542 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54542?
Check whether you run nimiq-primitives (crates.io) or Nimiq Core-Rs-Albatross at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nimiq-primitives (crates.io): upgrade to 1.6.0 or later
    cargo update -p nimiq-primitives

Technical details

An out-of-bounds read/panic exists in the `KeyNibbles::Add` function within `primitives/src/key_nibbles.rs`. The root cause is a lack of combined-length validation when concatenating a parent key with a child suffix from a `TrieChunk` proof, which can exceed the fixed 63-byte backing array. An attacker acting as a state-sync source can exploit this by providing a crafted proof; the panic occurs during deserialization before proof verification, meaning no valid cryptographic proof is required. The attack requires the victim to be in the state-sync phase and connected to the attacker's peer. The issue is fixed in version 1.6.0 by adding length checks during concatenation.

Affected products

  • Nimiq nimiq-primitives <= 1.5.1
  • Nimiq core-rs-albatross <= 1.5.1

Identifiers

  • CVE-2026-54542
  • GHSA-5rg2-xv9j-gv5p

Timeline

  • 2026-06-05: disclosed
  • 2026-07-16: advisory
  • 2026-07-16: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.