2 results · Clear filters · Feed
-
Medium 4.3
NIP-04 parsing amplifies malformed ciphertext memory use
The NIP-04 decryption parser split attacker-controlled content on every `?iv=` separator and collected all resulting segments before checking that the message had the expected two parts. It also Base64-decoded the complete IV text before checking that it repr…
-
Medium 5.5
Debug output exposes NIP-46 and NIP-60 credentials
Several NIP-46 and NIP-60 types used derived `Debug` implementations even though their fields contained credentials or decrypted application data. Formatting these values exposed NIP-46 connection secrets and request parameters, as well as NIP-60 private keys…