Nimiq vulnerabilities
28 CVEs and advisories name Nimiq as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-54541Nimiq: Panic in TrieProof::verify via child_index unwrap on equal-length keys
- CVE-2026-54542Nimiq: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserialized proof
- CVE-2026-46369Nimiq: Validity store off by one error
- CVE-2026-46545nimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed item
- CVE-2026-46543nimiq-blockchain: Genesis batch set request
- CVE-2026-46542nimiq-keys: Denial of service in Ed25519 multisig delinearization via invalid curve points
- CVE-2026-46541Nimiq network-libp2p: DHT query poisoning via first-record verification failure
- CVE-2026-46540Nimiq light-blockchain: Light blockchain rebranch issue
- CVE-2026-46539nimiq-primitives: BlockInclusionProof interlink issue when hops are empty
- CVE-2026-44505Nimiq network-libp2p: Untrusted peer can wedge DHT
- CVE-2026-40094nimiq-blockchain: network-libp2p untrusted peer can crash address book via empty peer contact addresses
- CVE-2026-40092nimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHT
- CVE-2026-34068nimiq-transaction: UpdateValidator transactions allows voting key change without proof-of-knowledge
- CVE-2026-34067nimiq-transaction vulnerable to panic via `HistoryTreeProof` length mismatch
- CVE-2026-34066nimiq-blockchain: Peer-triggerable panic during history sync
- CVE-2026-34065nimiq-primitives: Node crash due to missing interlink validation in election macro block proposals
- CVE-2026-34064nimiq-account: Vesting insufficient funds error can panic
- CVE-2026-34063network-libp2p: Peer can crash the node by opening discovery protocol substream twice
- CVE-2026-34062Nimiq has Allocation of Resources Without Limits or Throttling in its libp2p request/response
- CVE-2026-33471nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation
- CVE-2026-34069nimiq-consensus panics via RequestMacroChain micro-block locator
- CVE-2026-32605Nimiq: Remote crash via off-by-one signer bounds check in proposal buffer
- CVE-2026-40093nimiq-blockchain is missing a wall-clock upper bound on block timestamps
- CVE-2026-35468nimiq/core-rs-albatross: Panic in history index request handlers when a full node runs without the history index
- CVE-2026-33184nimiq/core-rs-albatross: Discovery handshake limit could underflow and later provoke a deterministic overflow panic
- CVE-2026-34061nimiq/core-rs-albatross: Macro block proposal interlink bug
- CVE-2026-28402nimiq/core-rs-albatross's nimiq-blockchain missing proposal body root verification
- CVE-2025-47270nimiq-network-libp2p Uncontrolled Resource Consumption vulnerability