{"id":"RUSTSEC-2026-0232","summary":"Processing of unverified relay events","details":"The processed events received from a relay through admission-policy and database\npaths before verifying that the serialized fields matched the claimed event ID and\nsignature. In particular, a database result for the claimed ID could cause\nverification to be skipped. The verification cache also keyed successful checks by a\n64-bit hash instead of the complete event ID.\n\nA malicious relay could send an event whose claimed ID referred to a known database\nentry while its content, tags, author, or signature differed from that ID. The forged\nevent could then reach policy callbacks or other SDK processing as if it were\nauthentic. A cache-key collision provided a second path for an unverified event to be\ntreated as previously verified. This undermines event integrity but does not reveal\nprivate keys or enable the attacker to produce a valid signature for the altered\nevent.\n\nThe SDK now verifies each event before policy evaluation, database lookup, or\npropagation decisions, and the verification cache stores the complete `EventId` so a\ntruncated hash collision cannot stand in for successful verification.","modified":"2026-08-02T18:00:03.847808345Z","published":"2026-08-01T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/nostr-relay-pool"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0232.html"},{"type":"WEB","url":"https://github.com/nostrdevkit/nostr/commit/4b67f9b45909d2e35f34c30c084c0ab66e599a9f"}],"affected":[{"package":{"name":"nostr-relay-pool","ecosystem":"crates.io","purl":"pkg:cargo/nostr-relay-pool"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.44.3"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"os":[],"functions":[],"arch":[]}},"database_specific":{"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0232.json","cvss":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","informational":null,"categories":["crypto-failure"]}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}