Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk proof containing two TrieProofNode values with identical keys. TrieProof::verify calls TrieProofNode::child_index in primitives/src/trie/trie_proof_node.rs, where is_prefix_of accepts equal keys and KeyNibbles::get is called at the key length, returns None, and is unconditionally unwrapped. Untrusted ResponseChunk data reaches commit_chunks, put_chunk, and proof.verify before cryptographic proof validation, so the attacker does not need a valid proof. Exploitation requires the attacker to be selected as the victim's sync peer during state sync, and the resulting panic is transient because the node restarts and resynchronizes. This issue is fixed in version 1.6.0.
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk whose proof contains a TrieNodeChild suffix that is individually valid but exceeds the 63-byte KeyNibbles backing array when combined with the parent key. KeyNibbles::Add in primitives/src/key_nibbles.rs performs the combined slice operation without checking the total length, and the input reaches put_chunk, TrieNodeChild::key, and TrieNodeChild::is_stump before proof.verify, so the attacker does not need a valid cryptographic proof. Exploitation requires the attacker to be selected as the victim's sync peer during state sync. The resulting out-of-bounds panic is transient because the node restarts and resynchronizes. This issue is fixed in version 1.6.0.
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Through 1.5.0, the validity store uses a strict lower-bound comparison that expires a stored transaction too early relative to Transaction::is_valid_at, allowing a remote attacker to replay the same signed transaction during a blocks_per_batch minus one block window and cause the sender and recipient balances to be updated twice. This issue is fixed in version 1.5.1.
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.5.0, a remote, unauthenticated denial-of-service vulnerability in MerkleRadixTrie::put_chunk allows any state-sync peer to crash any node performing state synchronization (freshly joining nodes and recovering nodes). This issue has been patched in version 1.5.0.
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.5.0, a remote peer can crash any full node by sending a RequestBatchSet message containing the genesis block's hash. The handler calls get_epoch_chunks which iterates backwards through macro blocks using Policy::macro_block_before. When it reaches the genesis block number, macro_block_before panics with "No macro blocks before genesis block". This issue has been patched in version 1.5.0.
A denial-of-service vulnerability exists in nimiq core-rs-albatross prior to version 1.4.0. The Ed25519PublicKey::delinearize() function calls unwrap() on curve point decompression, which panics if given invalid public key bytes that do not represent a valid point on the Ed25519 curve. This can crash the hosting process. The issue is fixed in version 1.4.0.
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, iIn handle_dht_get(), the DhtResults accumulator is only initialized when the first DHT record passes verification. If the first record fails (from a malicious DHT node), DhtResults is never created, and all subsequent valid records are discarded with "DHT inconsistent state" errors. This issue has been patched in version 1.4.0.
Nimiq core-rs-albatross versions prior to 1.4.0 contain a vulnerability where the LightBlockchain::rebranch() function improperly updates blockchain state when adopting a fork chain ending in a macro block. This leads to stale macro block and validator state, causing verification failures and stalling the light client's chain progression. The issue is fixed in version 1.4.0.
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, a logic flaw in BlockInclusionProof::is_block_proven causes the function to return true without performing any cryptographic verification when get_interlink_hops yields an empty hop list. This occurs when the target block is at the election block position immediately preceding the election head's epoch. An attacker providing transaction inclusion proofs can forge a MacroBlock header for that epoch position and have it accepted as "proven" without any hash or signature verification. This issue has been patched in version 1.4.0.
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. network-libp2p handles kad get-record query progress in handle_dht_get (network-libp2p/src/swarm.rs). Prior to version 1.4.0, when a peer returns a FoundRecord, the code verifies the record via dht_verifier.verify(&record.record). On verifier error, handle_dht_get logs and returns early without completing the oneshot used by Network::dht_get, and without cleaning up per-query bookkeeping. Later query progress can hit the "DHT inconsistent state" path and also return without cleanup. Because Network::dht_get awaits the oneshot without a timeout, the caller future can hang indefinitely. This issue has been patched in version 1.4.0.
nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In versions 1.3.0 and prior, network-libp2p discovery accepts signed PeerContact updates from untrusted peers and stores them in a peer contact book, eventually leading to address book crash. A PeerContact can legally contain an empty addresses list (no intrinsic validation enforces non-empty). Later, PeerContactBook::known_peers builds an address book by taking addresses.first().expect("every peer should have at least one address"). If the attacker has inserted a signed peer contact with addresses=[], any call to get_address_book (RPC/web client) can panic and crash the node/RPC task depending on panic settings. This issue has been fixed in version 1.4.0.
nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In versions 1.3.0 and below, a malicious network peer can crash any Nimiq full node by publishing a crafted Kademlia DHT record. The maliciously crafted record would contain a TaggedSigned<ValidatorRecord, KeyPair> with a signature field whose byte length is not exactly 64 in order to cause a crash. When the victim node's DHT verifier calls TaggedSigned::verify, execution reaches Ed25519Signature::from_bytes(sig).unwrap() in the TaggedPublicKey implementation for Ed25519PublicKey. The from_bytes call fails because ed25519_zebra::Signature::try_from rejects slices not 64 bytes, and the unwrap() panics. The BLS TaggedPublicKey implementation correctly returns false on error; only the Ed25519 implementation panics. This issue has been fixed in version 1.4.0.
A vulnerability in nimiq-transaction prior to version 1.3.0 allows improper verification of cryptographic signatures in the staking contract's UpdateValidator transactions. Specifically, the contract accepts transactions that set a new voting key without requiring the associated proof of knowledge, enabling a potential BLS rogue-key attack. This flaw could allow an attacker to forge a quorum-looking justification by producing only a single signature due to aggregated BLS signature verification. The vulnerability has a medium severity with a CVSS score of 6.8. Exploitation is considered low likelihood because the attacker would need knowledge of the next epoch validator set, which is chosen unpredictably. The issue is fixed in version 1.3.
CVE-2026-34067 is a low-severity vulnerability in the nimiq-transaction Rust library used by Nimiq. Before version 1.3.0, the function HistoryTreeProof::verify contains an assertion that panics if a malformed proof has mismatched lengths between history and positions arrays. Since the proof data is attacker-controlled from untrusted peer-to-peer network responses, a malicious actor could cause the application to crash by sending a crafted proof with length mismatch. The issue is fixed in version 1.3.0. No workarounds are known.
A vulnerability in nimiq-blockchain versions prior to 1.3.0 allows a remote peer to cause a panic via improper input validation in the HistoryStore component. Specifically, the function put_historic_txns uses an assert to enforce block number invariants, which can be violated by a malformed history list during history synchronization, leading to a denial of service. The issue is fixed in version 1.3.0. No known workarounds exist.
A vulnerability in nimiq-primitives versions prior to 1.3.0 allows an untrusted peer to cause a node to panic by sending an election macro block with an invalid compressed BLS voting key. This occurs because the code does not properly handle errors when uncompressing the voting key, leading to a panic and denial of service. The issue is fixed in version 1.3.0. No known workarounds exist.
CVE-2026-34064 is an integer underflow vulnerability in the nimiq-account Rust implementation prior to version 1.3.0. The issue occurs in the VestingContract::can_change_balance function, where an underflow panic can crash the node if an attacker creates a vesting contract with a total_amount exceeding the actual contract balance. This leads to a panic during mempool admission and block processing when an outgoing transaction triggers the vulnerable code path. The vulnerability has a medium severity with a CVSS score of 5.3. A patch fixing this issue is included in version 1.3.0.
A reachable assertion vulnerability exists in Nimiq's network-libp2p prior to version 1.3.0. The network-libp2p discovery protocol handler incorrectly assumes only one inbound and one outbound discovery substream per connection. If a remote peer opens a second discovery substream on the same connection, the handler triggers a panic, causing the networking task to crash and the node's p2p networking to go offline until restarted. This denial-of-service condition affects availability but does not impact confidentiality or integrity. The issue is fixed in version 1.3.0. No known workarounds are available.
CVE-2026-34062 is a medium severity vulnerability in the nimiq network-libp2p prior to version 1.3.0. It involves allocation of resources without limits or throttling, where inbound substreams can be kept open indefinitely by a remote peer sending only partial frames. This leads to a larger stalled-slot budget than intended, potentially causing denial of service by exhausting resources. The issue is addressed in version 1.3.0, which includes a formal patch. No known workarounds exist.
CVE-2026-33471 is a critical vulnerability in the nimiq-block Rust implementation prior to version 1.3.0. It involves improper input validation in the SkipBlockProof::verify function, where out-of-range signer indices can be exploited to bypass quorum checks. This allows a malicious validator with fewer than the required number of signer slots to pass verification by manipulating signature aggregation. The vulnerability has a CVSS score of 9.6, indicating high impact on integrity and availability. A patch fixing this issue was included in version 1.3.0.