github.com/nats-io/nats-server (Go)
Advisories
35
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 2.7.4 or later clears every advisory below that has a fix.
Upgrade commands
go
go get github.com/nats-io/nats-server@v2.7.4 && go mod tidyKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-pq2q-rcw4-3hr6 NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead |
High EPSS 0.59% |
all versions | No fix yet |
| GHSA-pq2q-rcw4-3hr6 NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead |
High EPSS 0.59% |
all versions | No fix yet |
| GHSA-3f24-pcvm-5jqc NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching |
Medium EPSS 0.15% |
all versions | No fix yet |
| GHSA-3f24-pcvm-5jqc NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching |
Medium EPSS 0.15% |
all versions | No fix yet |
| GHSA-55h8-8g96-x4hj NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers |
Medium EPSS 0.15% |
all versions | No fix yet |
| GHSA-55h8-8g96-x4hj NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers |
Medium EPSS 0.15% |
all versions | No fix yet |
| GHSA-pwx7-fx9r-hr4h NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing |
Medium EPSS 0.21% |
all versions | No fix yet |
| GHSA-pwx7-fx9r-hr4h NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing |
Medium EPSS 0.21% |
all versions | No fix yet |
| GHSA-9983-vrx2-fg9c NATS JetStream has an authorization bypass through its Management API |
Medium EPSS 0.32% |
all versions | No fix yet |
| GHSA-9983-vrx2-fg9c NATS JetStream has an authorization bypass through its Management API |
Medium EPSS 0.32% |
all versions | No fix yet |
| GHSA-8r68-gvr4-jh7j NATS is vulnerable to pre-auth DoS through WebSockets client service |
Medium EPSS 0.55% |
all versions | No fix yet |
| GHSA-8r68-gvr4-jh7j NATS is vulnerable to pre-auth DoS through WebSockets client service |
Medium EPSS 0.55% |
all versions | No fix yet |
| GHSA-vprv-35vv-q339 NATS has pre-auth server panic via leafnode handling |
High EPSS 0.63% |
all versions | No fix yet |
| GHSA-vprv-35vv-q339 NATS has pre-auth server panic via leafnode handling |
High EPSS 0.63% |
all versions | No fix yet |
| GHSA-jxxm-27vp-c3m5 NATS allows MQTT clients to bypass ACL checks |
Medium EPSS 0.26% |
all versions | No fix yet |
| GHSA-jxxm-27vp-c3m5 NATS allows MQTT clients to bypass ACL checks |
Medium EPSS 0.26% |
all versions | No fix yet |
| GHSA-v722-jcv5-w7mc NATS has MQTT plaintext password disclosure |
High EPSS 0.37% |
all versions | No fix yet |
| GHSA-v722-jcv5-w7mc NATS has MQTT plaintext password disclosure |
High EPSS 0.37% |
all versions | No fix yet |
| GHSA-52jh-2xxh-pwh6 NATS Server panic via malicious compression on leafnode port |
High EPSS 0.68% |
all versions | No fix yet |
| GHSA-52jh-2xxh-pwh6 NATS Server panic via malicious compression on leafnode port |
High EPSS 0.68% |
all versions | No fix yet |
| GHSA-fcjp-h8cc-6879 NATS is vulnerable to MQTT hijacking via Client ID |
Medium EPSS 0.24% |
all versions | No fix yet |
| GHSA-x6g4-f6q3-fqvv NATS credentials are exposed in monitoring port via command-line argv |
Medium EPSS 0.43% |
all versions | No fix yet |
| GHSA-8m2x-3m6q-6w8j NATS: Message tracing can be redirected to arbitrary subject |
Medium EPSS 0.24% |
all versions | No fix yet |
| GHSA-qrvq-68c2-7grw nats-server websockets are vulnerable to pre-auth memory DoS |
High EPSS 0.55% |
<= 1.4.1 | No fix yet |
| GHSA-qrvq-68c2-7grw nats-server websockets are vulnerable to pre-auth memory DoS |
High EPSS 0.55% |
all versions | No fix yet |
| GHSA-2h2x-8hh2-mfq8 NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects |
Medium EPSS 0.48% |
all versions | No fix yet |
| GHSA-jj54-5q2m-q7pj NATS server TLS missing ciphersuite settings when CLI flags used |
Low | all versions | No fix yet |
| GO-2023-2066 NATS nats-server allows directory traversal via unintended path to a management action |
Critical EPSS 1.16% |
>= 2.2.0, < 2.7.4 | 2.7.4 |
| GO-2023-2066 NATS nats-server allows directory traversal via unintended path to a management action |
Critical EPSS 1.16% |
all versions | No fix yet |
| GHSA-6h3m-36w8-hv68 Arbitrary file write in nats-server |
Medium EPSS 2.34% |
all versions | No fix yet |
| GHSA-m4jx-6526-vvhm Denial of service in github.com/nats-io/nats-server/server |
High EPSS 3.73% |
< 2.2.0 | 2.2.0 |
| GHSA-m4jx-6526-vvhm Denial of service in github.com/nats-io/nats-server/server |
High EPSS 3.73% |
all versions | No fix yet |
| GHSA-g6w6-r76c-28j7 Incorrect Authorization in NATS nats-server |
High EPSS 1.33% |
all versions | No fix yet |
| GHSA-gwj5-3vfq-q992 Import loops in account imports, nats-server DoS |
High | all versions | No fix yet |
| GHSA-jp4j-47f9-2vc3 Integer Overflow or Wraparound in NATS Server |
High EPSS 1.77% |
all versions | No fix yet |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor