CVE-2026-54542

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk whose proof contains a TrieNodeChild suffix that is individually valid but exceeds the 63-byte KeyNibbles backing array when combined with the parent key. KeyNibbles::Add in primitives/src/key_nibbles.rs performs the combined slice operation without checking the total length, and the input reaches put_chunk, TrieNodeChild::key, and TrieNodeChild::is_stump before proof.verify, so the attacker does not need a valid cryptographic proof. Exploitation requires the attacker to be selected as the victim's sync peer during state sync. The resulting out-of-bounds panic is transient because the node restarts and resynchronizes. This issue is fixed in version 1.6.0.

• CWE-125

• https://github.com/nimiq/core-rs-albatross/commit/eabfc3e21731b0628c3f933163a0f1e1864217bf
• https://github.com/nimiq/core-rs-albatross/pull/3790
• https://github.com/nimiq/core-rs-albatross/releases/tag/v1.6.0
• https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-5rg2-xv9j-gv5p

Published

Sep 14, 2026

Last Modified

Sep 14, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54531pypdf is a free and open-source pure-python PDF library. Pri…5.5
• CVE-2026-54533vantage6 is an open-source infrastructure for privacy preser…6.9
• CVE-2026-54538xrdp is an open source RDP server. In versions 0.10.6 and pr…7.5
• CVE-2026-5454A vulnerability was found in GRID Organiser App up to 1.0.5 …3.3
• CVE-2026-54540Pheditor is a single-file editor and file manager written in…8.8
• CVE-2026-54541Nimiq is a Rust implementation of the Nimiq Proof-of-Stake p…3.7
• CVE-2026-54543Froxlor is open source server administration software. Prior…5.4
• CVE-2026-54544Fireshare facilitates self-hosted media and link sharing. Pr…7.2
• CVE-2026-54545wakaru is a JavaScript decompiler and unminifier toolkit. Fr…7.1
• CVE-2026-54546CloudTAK is a browser-based Common Operating Picture and sit…5
• CVE-2026-54547Meta Ads MCP is a Model Context Protocol (MCP) server that l…7.4
• CVE-2026-54548kas is a setup tool for bitbake based projects. Prior to 5.4…3.3