CVE-2026-40093 nimiq CVE debrief

Who should care

Defenders responsible for Nimiq Proof-Of-Stake implementation, blockchain security, and cryptocurrency systems should assess exposure and prioritize verification of patch levels and potential compensating controls.

Why it matters

CVE-2026-40093 allows malicious block-producing validators to manipulate block timestamps, potentially inflating the monetary supply and impacting reward calculations. Defenders should prioritize verifying patch levels and assessing exposure.

• Potential inflation of monetary supply beyond intended emission schedule
• Manipulation of reward calculations
• Need for verification of patch levels and compensating controls
• Potential impact on trust and stability of the Nimiq blockchain

Technical summary

The nimiq-blockchain library, used in Nimiq's Rust implementation, lacks an upper bound check for block timestamps. This allows a malicious block-producing validator to set timestamps arbitrarily far in the future. The vulnerability directly impacts reward calculations via Policy::supply_at() and batch_delay() in blockchain/src/reward.rs, potentially leading to an inflation of the monetary supply beyond the intended emission schedule.

Defensive priority

Defenders should prioritize verifying the patch level of their Nimiq Proof-Of-Stake implementation and assessing exposure to potential future block timestamp manipulation.

Recommended defensive actions

• Verify the patch level of Nimiq Proof-Of-Stake implementation
• Assess exposure to potential future block timestamp manipulation
• Review and update reward calculation logic to account for potential timestamp manipulation
• Implement compensating controls for exposed systems
• Monitor relevant logs and detection systems for exposed assets
• Track exceptions and retest remediated assets
• Review asset inventory for affected product deployments

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but evidence is limited regarding actual exploitation or specific affected versions beyond 1.3.0 and earlier. Defenders should verify patch levels, review reward calculation logic, and assess exposure to potential future block timestamp manipulation. Limited evidence exists on the scope of affected deployments or specific exploitation attempts. Official advisories and CVE metadata suggest prioritizing verification of patch levels and compensating controls.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.