# RUSTSEC-2026-0219 - Remote Denial of Service via malformed NIP-04 IV

Source: https://junglewise.ai/threats/rustsec-2026-0219-remote-denial-of-service-via-malformed-nip-04-iv-33ff36be  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-26  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2026-07-26

Remote Denial of Service via malformed NIP-04 IV

Technologies: [nostr (crates.io)](https://junglewise.ai/threats/technologies/nostr). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 26 July 2026.

**Which products and versions are affected?** nostr (crates.io) SEMVER:introduced=0.0.0-0,fixed=0.44.6,introduced=0.45.0-alpha.1,fixed=0.45.0-alpha.6.

**Is there a fix for This vulnerability?** Yes. nostr (crates.io): upgrade to 0.45.0-alpha.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected?** Check whether you run nostr (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nostr (crates.io): upgrade to 0.45.0-alpha.6 or later

  ```sh
  cargo update -p nostr
  ```


## Affected products

- nostr (crates.io) SEMVER:introduced=0.0.0-0,fixed=0.44.6,introduced=0.45.0-alpha.1,fixed=0.45.0-alpha.6

## Related threats

- [RUSTSEC-2026-0229 - NIP-98 authorization parsing permits resource exhaustion](https://junglewise.ai/threats/rustsec-2026-0229-nip-98-authorization-parsing-permits-resource-1b4e54be)
- [RUSTSEC-2026-0230 - Empty NIP-50 search filters can panic](https://junglewise.ai/threats/rustsec-2026-0230-empty-nip-50-search-filters-can-panic-1c74e3f8)
- [RUSTSEC-2026-0228 - NIP-04 parsing amplifies malformed ciphertext memory use](https://junglewise.ai/threats/rustsec-2026-0228-nip-04-parsing-amplifies-malformed-ciphertext-memory-411a6c4f)
- [RUSTSEC-2026-0225 - Debug output exposes NIP-46 and NIP-60 credentials](https://junglewise.ai/threats/rustsec-2026-0225-debug-output-exposes-nip-46-and-nip-60-credentials-69fe3562)
- [RUSTSEC-2026-0227 - NIP-44 v2 decryption permits resource exhaustion](https://junglewise.ai/threats/rustsec-2026-0227-nip-44-v2-decryption-permits-resource-exhaustion-6b2af13a)