# cve.now: Nimiq

The newest entries naming Nimiq as an affected vendor (up to 200), of 28 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-54541](https://cve.now/CVE-2026-54541.md): Nimiq: Panic in TrieProof::verify via child\_index unwrap on equal-length keys (CVSS 3.7)
- [CVE-2026-54542](https://cve.now/CVE-2026-54542.md): Nimiq: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserialized proof (CVSS 3.7)
- [CVE-2026-46369](https://cve.now/CVE-2026-46369.md): Nimiq: Validity store off by one error (CVSS 7.5)
- [CVE-2026-46545](https://cve.now/CVE-2026-46545.md): nimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed item (CVSS 7.5)
- [CVE-2026-46543](https://cve.now/CVE-2026-46543.md): nimiq-blockchain: Genesis batch set request (CVSS 5.3)
- [CVE-2026-46542](https://cve.now/CVE-2026-46542.md): nimiq-keys: Denial of service in Ed25519 multisig delinearization via invalid curve points (CVSS 4.3)
- [CVE-2026-46541](https://cve.now/CVE-2026-46541.md): Nimiq network-libp2p: DHT query poisoning via first-record verification failure (CVSS 7.5)
- [CVE-2026-46540](https://cve.now/CVE-2026-46540.md): Nimiq light-blockchain: Light blockchain rebranch issue (CVSS 6.5)
- [CVE-2026-46539](https://cve.now/CVE-2026-46539.md): nimiq-primitives: BlockInclusionProof interlink issue when hops are empty (CVSS 5.9)
- [CVE-2026-44505](https://cve.now/CVE-2026-44505.md): Nimiq network-libp2p: Untrusted peer can wedge DHT (CVSS 5.3)
- [CVE-2026-40094](https://cve.now/CVE-2026-40094.md): nimiq-blockchain: network-libp2p untrusted peer can crash address book via empty peer contact addresses (CVSS 4.3)
- [CVE-2026-40092](https://cve.now/CVE-2026-40092.md): nimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHT (CVSS 7.5)
- [CVE-2026-34068](https://cve.now/CVE-2026-34068.md): nimiq-transaction: UpdateValidator transactions allows voting key change without proof-of-knowledge (CVSS 6.8)
- [CVE-2026-34067](https://cve.now/CVE-2026-34067.md): nimiq-transaction vulnerable to panic via \`HistoryTreeProof\` length mismatch (CVSS 3.1)
- [CVE-2026-34066](https://cve.now/CVE-2026-34066.md): nimiq-blockchain: Peer-triggerable panic during history sync (CVSS 5.3)
- [CVE-2026-34065](https://cve.now/CVE-2026-34065.md): nimiq-primitives: Node crash due to missing interlink validation in election macro block proposals (CVSS 7.5)
- [CVE-2026-34064](https://cve.now/CVE-2026-34064.md): nimiq-account: Vesting insufficient funds error can panic (CVSS 5.3)
- [CVE-2026-34063](https://cve.now/CVE-2026-34063.md): network-libp2p: Peer can crash the node by opening discovery protocol substream twice (CVSS 7.5)
- [CVE-2026-34062](https://cve.now/CVE-2026-34062.md): Nimiq has Allocation of Resources Without Limits or Throttling in its libp2p request/response (CVSS 5.3)
- [CVE-2026-33471](https://cve.now/CVE-2026-33471.md): nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation (CVSS 9.6)
- [CVE-2026-34069](https://cve.now/CVE-2026-34069.md): nimiq-consensus panics via RequestMacroChain micro-block locator (CVSS 5.3)
- [CVE-2026-32605](https://cve.now/CVE-2026-32605.md): Nimiq: Remote crash via off-by-one signer bounds check in proposal buffer (CVSS 7.5)
- [CVE-2026-40093](https://cve.now/CVE-2026-40093.md): nimiq-blockchain is missing a wall-clock upper bound on block timestamps (CVSS 8.1)
- [CVE-2026-35468](https://cve.now/CVE-2026-35468.md): nimiq/core-rs-albatross: Panic in history index request handlers when a full node runs without the history index (CVSS 5.3)
- [CVE-2026-33184](https://cve.now/CVE-2026-33184.md): nimiq/core-rs-albatross: Discovery handshake limit could underflow and later provoke a deterministic overflow panic (CVSS 7.5)
- [CVE-2026-34061](https://cve.now/CVE-2026-34061.md): nimiq/core-rs-albatross: Macro block proposal interlink bug (CVSS 4.9)
- [CVE-2026-28402](https://cve.now/CVE-2026-28402.md): nimiq/core-rs-albatross's nimiq-blockchain missing proposal body root verification (CVSS 7.1)
- [CVE-2025-47270](https://cve.now/CVE-2025-47270.md): nimiq-network-libp2p Uncontrolled Resource Consumption vulnerability (CVSS 7.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/nimiq
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.