nimiq-blockchain Package Vulnerability: Validity Store Off-by-One Error
- Severity
- HIGH
- Affected component
- nimiq-blockchain (cargo)
- Affected versions
- < 1.5.1 or <= 1.3.0 or <= 0.2.0 or < 1.5.0
- Patched version
- Not yet available
An early warning has been issued for a high-severity vulnerability in the nimiq-blockchain package. The vulnerability, tracked as GHSA-3763-qp59-59vf, is a validity store off-by-one error that could allow an attacker to replay signed transactions, resulting in double debits and credits.
What happened
The nimiq-blockchain package has reportedly been found to contain a validity store off-by-one error. This error allows an attacker to replay the same signed transaction in a contiguous window of blocks. As a result, the sender is debited and the recipient is credited twice. The vulnerability is under investigation and has not yet been exploited in the wild.
The affected versions of nimiq-blockchain are those less than 1.5.1, less than or equal to 1.3.0, less than or equal to 0.2.0, and less than 1.5.0. Users of these versions are advised to assess their exposure and prepare for an upgrade once a patched version is released.
What to do about it
- Monitor the primary sources for updates on the patched version of nimiq-blockchain.
- Assess your current version of nimiq-blockchain to determine if you are using an affected version.
- Prepare to upgrade to the patched version of nimiq-blockchain once it is released.
- No official fix has been published yet. Monitor the sources below for updates.
How 0Day would have caught this
nimiq-blockchain is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using nimiq-blockchain versions less than 1.5.1, less than or equal to 1.3.0, less than or equal to 0.2.0, or less than 1.5.0.
What should I do right now?
Monitor the primary sources for updates on the patched version of nimiq-blockchain and prepare to upgrade once it is released.
When will a fix be available?
No official fix has been published yet. Monitor the sources below for updates.
How can I assess my exposure?
Check your current version of nimiq-blockchain against the affected version ranges provided in the threat data.