Out-of-Bounds Write in Nimiq Proof-of-Stake Implementation by Nimiq

CVE-2026-54542

What is CVE-2026-54542?

A vulnerability exists in the Nimiq Proof-of-Stake implementation prior to version 1.6.0, where a malicious state-sync peer can crash a node by sending a specially crafted TrieChunk. This TrieChunk contains a valid TrieNodeChild suffix that, when combined with the parent key, exceeds the 63-byte limit of the KeyNibbles backing array. This oversight allows the exploitation of the combined slice operation without proper length validation, leading to an out-of-bounds panic. Although this issue causes a temporary crash, the affected node is designed to restart and resynchronize. The vulnerability is resolved in version 1.6.0.

References