# CVE-2026-54542

## Summary

- **CVE ID:** CVE-2026-54542
- **Severity:** LOW
- **CVSS Score:** 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
- **CWE:** CWE-125
- **Published:** Sep 14, 2026
- **Last Modified:** Sep 14, 2026

## Description

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk whose proof contains a TrieNodeChild suffix that is individually valid but exceeds the 63-byte KeyNibbles backing array when combined with the parent key. KeyNibbles::Add in primitives/src/key_nibbles.rs performs the combined slice operation without checking the total length, and the input reaches put_chunk, TrieNodeChild::key, and TrieNodeChild::is_stump before proof.verify, so the attacker does not need a valid cryptographic proof. Exploitation requires the attacker to be selected as the victim's sync peer during state sync. The resulting out-of-bounds panic is transient because the node restarts and resynchronizes. This issue is fixed in version 1.6.0.

## Affected Products

- nimiq — core-rs-albatross (< 1.6.0)

## References

- [CNA](https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-5rg2-xv9j-gv5p)
- [CNA](https://github.com/nimiq/core-rs-albatross/pull/3790)
- [CNA](https://github.com/nimiq/core-rs-albatross/commit/eabfc3e21731b0628c3f933163a0f1e1864217bf)
- [CNA](https://github.com/nimiq/core-rs-albatross/releases/tag/v1.6.0)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.27%
- **EPSS Percentile:** 20.1

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-19._