CVE-2026-54542

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk whose proof contains a TrieNodeChild suffix that is individually valid but exceeds the 63-byte KeyNibbles backing array when combined with the parent key. KeyNibbles::Add in primitives/src/key_nibbles.rs performs the combined slice operation without checking the total length, and the input reaches put_chunk, TrieNodeChild::key, and TrieNodeChild::is_stump before proof.verify, so the attacker does not need a valid cryptographic proof. Exploitation requires the attacker to be selected as the victim's sync peer during state sync. The resulting out-of-bounds panic is transient because the node restarts and resynchronizes. This issue is fixed in version 1.6.0.

CVSS 3.1

3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-25)

CWE

CWE-125

Published

2026-09-14

Modified

2026-09-30

Record from

the NVD, synced 2026-10-19

Packages (OSV)

References

• https://github.com/nimiq/core-rs-albatross/commit/eabfc3e21731b0628c3f933163a0f1e1864217bf
• https://github.com/nimiq/core-rs-albatross/pull/3790
• https://github.com/nimiq/core-rs-albatross/releases/tag/v1.6.0
• https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-5rg2-xv9j-gv5p

Check your stackJSON