https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T05:09:53.059713+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-1619 EUVD-2026-1619 2026-10-16T05:09:53.062437+00:00 EUVD-2026-1619 https://cve.radiocsirt.org/vuln/fkie_cve-2024-41962 fkie_cve-2024-41962 2026-10-16T05:09:53.062488+00:00

Bostr is an nostr relay aggregator proxy that acts like a regular nostr relay. bostr let everyone in even having authorized_keys being set when noscraper is set to true. This vulnerability is fixed in 3.0.10.

 https://cve.radiocsirt.org/vuln/ghsa-5cf7-cxrf-mq73 GHSA-5cf7-cxrf-mq73 — Bostr Improper Authorization vulnerability 2026-10-16T05:09:53.062534+00:00

Affected: npm: bostr

Even with `authorized_keys` is filled with allowed pubkeys, If `noscraper` is enabled, It will allow anyone to use bouncer even it's pubkey is not in `authorized_keys`.

### Impact - Private bouncer

### Patches Available on version [3.0.10](https://github.com/Yonle/bostr/releases/tag/3.0.10)

### Workarounds Disable `noscraper` if you have `authorized_keys` being set in config

### References This [line of code](https://github.com/Yonle/bostr/blob/8665374a66e2afb9f92d0414b0d6f420a95d5d2d/auth.js#L21) is the cause.