Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Through 1.5.0, the validity store uses a strict lower-bound comparison that expires a stored transaction too early relative to Transaction::is_valid_at, allowing a remote attacker to replay the same signed transaction during a blocks_per_batch minus one block window and cause the sender and recipient balances to be updated twice. This issue is fixed in version 1.5.1.

CVE-2026-46369 affects Nimiq, a Rust implementation of the Nimiq Proof-of-Stake protocol using the Albatross consensus algorithm. In versions through 1.5.0, the validity store uses a strict lower-bound comparison that causes stored transactions to expire too early relative to Transaction::is_valid_at. This flaw allows a remote attacker to replay the same signed transaction during a window of blocks_per_batch minus one blocks. The result is that sender and recipient balances are updated twice, effectively enabling double-spend or balance manipulation. The vulnerability is remotely exploitable without authentication. The issue has been patched in version 1.5.1. Users are advised to upgrade immediately to mitigate the risk of transaction replay attacks.