Issues

• RUSTSEC-2026-0368: zip: ZipArchive::extract creates symbolic links whose attacker-controlled targets are outside the destination directory

  getAlby/ldk-node#114 · Filter by author github-actions opened on Oct 17, 2026

• RUSTSEC-2026-0367: Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation

  getAlby/ldk-node#113 · Filter by author github-actions opened on Oct 17, 2026

• RUSTSEC-2026-0369: ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target

  getAlby/ldk-node#112 · Filter by author github-actions opened on Oct 17, 2026

• RUSTSEC-2025-0134: rustls-pemfile is unmaintained

  getAlby/ldk-node#111 · Filter by author github-actions opened on Oct 16, 2026

• RUSTSEC-2024-0436: paste - no longer maintained

  getAlby/ldk-node#110 · Filter by author github-actions opened on Oct 16, 2026

• RUSTSEC-2026-0099: Name constraints were accepted for certificates asserting a wildcard name

  getAlby/ldk-node#108 · Filter by author github-actions opened on Oct 16, 2026

• RUSTSEC-2025-0141: Bincode is unmaintained

  getAlby/ldk-node#109 · Filter by author github-actions opened on Oct 16, 2026

• RUSTSEC-2026-0104: Reachable panic in certificate revocation list parsing

  getAlby/ldk-node#107 · Filter by author github-actions opened on Oct 16, 2026

• RUSTSEC-2026-0098: Name constraints for URI names were incorrectly accepted

  getAlby/ldk-node#106 · Filter by author github-actions opened on Oct 16, 2026

• RUSTSEC-2026-0346: Debug impls for client session values expose TLS secrets

  getAlby/ldk-node#105 · Filter by author github-actions opened on Oct 16, 2026

• RUSTSEC-2026-0349: Unauthenticated ServerHello can downgrade later connections to classical key exchange

  getAlby/ldk-node#104 · Filter by author github-actions opened on Oct 16, 2026

• RUSTSEC-2026-0347: Buffered application data sent to outer server after ECH rejection

  getAlby/ldk-node#102 · Filter by author github-actions opened on Oct 16, 2026

• RUSTSEC-2026-0348: Brotli certificate decompression can allocate up to 1 GiB before authentication

  getAlby/ldk-node#103 · Filter by author github-actions opened on Oct 16, 2026

• RUSTSEC-2026-0346: Debug impls for client session values expose TLS secrets

  getAlby/ldk-node#101 · Filter by author github-actions opened on Oct 16, 2026

• RUSTSEC-2026-0349: Unauthenticated ServerHello can downgrade later connections to classical key exchange

  getAlby/ldk-node#100 · Filter by author github-actions opened on Oct 16, 2026

• RUSTSEC-2026-0258: h2 unbounded empty DATA frames

  getAlby/ldk-node#99 · Filter by author github-actions opened on Oct 16, 2026

• Increase historical penalty and re-review LDK penalties

  getAlby/ldk-node#76 · Filter by author rolznz opened on Jun 23, 2025
  

• Extract Sqlite -> VSS migration code to separate function

  getAlby/ldk-node#58 · Filter by author rolznz opened on Dec 11, 2024
  1

• Consider supporting TLV 34349334 (basic text message) for keysend payments (like Amboss keysend billboard)

  getAlby/ldk-node#32 · Filter by author rolznz opened on Jun 14, 2024
  1