{"id":"RUSTSEC-2026-0231","summary":"Relay authentication challenges can exhaust memory","details":"The SDK forwarded every NIP-42 `AUTH` challenge received from a relay through an\nunbounded command queue. Challenge handling can wait for an asynchronous signer or\nuser interaction, so receiving challenges was substantially faster than completing\nthe corresponding authentication work.\n\nA malicious relay could continuously send new challenges without authenticating or\ndelivering valid events. Every value remained queued, causing memory use and pending\nsigner operations to grow without a fixed limit until the client became unavailable.\nThe issue does not allow the relay to forge a signature or learn the client's private\nkey.\n\nThe SDK now coalesces pending challenges through a latest-value channel. NIP-42 makes\nan earlier challenge invalid when the relay sends a new one, so replacing pending\nwork preserves the only challenge that can still be answered while keeping memory\nuse bounded.","modified":"2026-08-02T18:00:03.803441271Z","published":"2026-08-01T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/nostr-relay-pool"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0231.html"},{"type":"WEB","url":"https://github.com/nostrdevkit/nostr/commit/6eb8766caa25f03803f178861be054f3bca718d7"}],"affected":[{"package":{"name":"nostr-relay-pool","ecosystem":"crates.io","purl":"pkg:cargo/nostr-relay-pool"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.44.3"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"functions":[],"arch":[],"os":[]}},"database_specific":{"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0231.json","categories":["denial-of-service"],"cvss":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}