# RUSTSEC-2026-0225 - Debug output exposes NIP-46 and NIP-60 credentials

Source: https://junglewise.ai/threats/rustsec-2026-0225-debug-output-exposes-nip-46-and-nip-60-credentials-69fe3562  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-01  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2026-08-01

Debug output exposes NIP-46 and NIP-60 credentials

Technologies: [nostr (crates.io)](https://junglewise.ai/threats/technologies/nostr). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 1 August 2026.

**Which products and versions are affected?** nostr (crates.io) SEMVER:introduced=0.0.0-0,fixed=0.44.7.

**Is there a fix for This vulnerability?** Yes. nostr (crates.io): upgrade to 0.44.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected?** Check whether you run nostr (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nostr (crates.io): upgrade to 0.44.7 or later

  ```sh
  cargo update -p nostr
  ```


## Affected products

- nostr (crates.io) SEMVER:introduced=0.0.0-0,fixed=0.44.7

## Related threats

- [RUSTSEC-2026-0229 - NIP-98 authorization parsing permits resource exhaustion](https://junglewise.ai/threats/rustsec-2026-0229-nip-98-authorization-parsing-permits-resource-1b4e54be)
- [RUSTSEC-2026-0230 - Empty NIP-50 search filters can panic](https://junglewise.ai/threats/rustsec-2026-0230-empty-nip-50-search-filters-can-panic-1c74e3f8)
- [RUSTSEC-2026-0228 - NIP-04 parsing amplifies malformed ciphertext memory use](https://junglewise.ai/threats/rustsec-2026-0228-nip-04-parsing-amplifies-malformed-ciphertext-memory-411a6c4f)
- [RUSTSEC-2026-0227 - NIP-44 v2 decryption permits resource exhaustion](https://junglewise.ai/threats/rustsec-2026-0227-nip-44-v2-decryption-permits-resource-exhaustion-6b2af13a)
- [RUSTSEC-2026-0226 - Wallet event parsers accept unauthenticated events](https://junglewise.ai/threats/rustsec-2026-0226-wallet-event-parsers-accept-unauthenticated-events-807ec808)