github.com/nats-io/nats-server/v2 (Go)
Advisories
70
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 2.12.6 or later clears every advisory below that has a fix.
Upgrade commands
go
go get github.com/nats-io/nats-server/v2@v2.12.6 && go mod tidyKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-pq2q-rcw4-3hr6 NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead |
High EPSS 0.59% |
>= 2.2.0, < 2.11.14 | 2.11.14 |
| GHSA-pq2q-rcw4-3hr6 NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead |
High EPSS 0.59% |
>= 2.2.0, < 2.11.14>= 2.12.0, < 2.12.5 | 2.11.142.12.5 |
| GHSA-pq2q-rcw4-3hr6 NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead |
High EPSS 0.59% |
>= 2.12.0, < 2.12.5 | 2.12.5 |
| GHSA-3f24-pcvm-5jqc NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching |
Medium EPSS 0.15% |
< 2.11.15 | 2.11.15 |
| GHSA-3f24-pcvm-5jqc NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching |
Medium EPSS 0.15% |
< 2.11.15>= 2.12.0-RC.1, < 2.12.6 | 2.11.152.12.6 |
| GHSA-3f24-pcvm-5jqc NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching |
Medium EPSS 0.15% |
>= 2.12.0-RC.1, < 2.12.6 | 2.12.6 |
| GHSA-55h8-8g96-x4hj NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers |
Medium EPSS 0.15% |
< 2.11.15 | 2.11.15 |
| GHSA-55h8-8g96-x4hj NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers |
Medium EPSS 0.15% |
< 2.11.15>= 2.12.0-RC.1, < 2.12.6 | 2.11.152.12.6 |
| GHSA-55h8-8g96-x4hj NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers |
Medium EPSS 0.15% |
>= 2.12.0-RC.1, < 2.12.6 | 2.12.6 |
| GHSA-pwx7-fx9r-hr4h NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing |
Medium EPSS 0.21% |
< 2.11.15>= 2.12.0-RC.1, < 2.12.6 | 2.11.152.12.6 |
| GHSA-pwx7-fx9r-hr4h NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing |
Medium EPSS 0.21% |
< 2.11.15 | 2.11.15 |
| GHSA-pwx7-fx9r-hr4h NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing |
Medium EPSS 0.21% |
>= 2.12.0-RC.1, < 2.12.6 | 2.12.6 |
| GHSA-9983-vrx2-fg9c NATS JetStream has an authorization bypass through its Management API |
Medium EPSS 0.32% |
< 2.11.15 | 2.11.15 |
| GHSA-9983-vrx2-fg9c NATS JetStream has an authorization bypass through its Management API |
Medium EPSS 0.32% |
< 2.11.15>= 2.12.0-RC.1, < 2.12.6 | 2.11.152.12.6 |
| GHSA-9983-vrx2-fg9c NATS JetStream has an authorization bypass through its Management API |
Medium EPSS 0.32% |
>= 2.12.0-RC.1, < 2.12.6 | 2.12.6 |
| GHSA-8r68-gvr4-jh7j NATS is vulnerable to pre-auth DoS through WebSockets client service |
Medium EPSS 0.55% |
< 2.11.15>= 2.12.0-RC.1, < 2.12.6 | 2.11.152.12.6 |
| GHSA-8r68-gvr4-jh7j NATS is vulnerable to pre-auth DoS through WebSockets client service |
Medium EPSS 0.55% |
< 2.11.15 | 2.11.15 |
| GHSA-8r68-gvr4-jh7j NATS is vulnerable to pre-auth DoS through WebSockets client service |
Medium EPSS 0.55% |
>= 2.12.0-RC.1, < 2.12.6 | 2.12.6 |
| GHSA-vprv-35vv-q339 NATS has pre-auth server panic via leafnode handling |
High EPSS 0.63% |
< 2.11.15>= 2.12.0-RC.1, < 2.12.6 | 2.11.152.12.6 |
| GHSA-vprv-35vv-q339 NATS has pre-auth server panic via leafnode handling |
High EPSS 0.63% |
< 2.11.15 | 2.11.15 |
| GHSA-vprv-35vv-q339 NATS has pre-auth server panic via leafnode handling |
High EPSS 0.63% |
>= 2.12.0-RC.1, < 2.12.6 | 2.12.6 |
| GHSA-jxxm-27vp-c3m5 NATS allows MQTT clients to bypass ACL checks |
Medium EPSS 0.26% |
< 2.11.15 | 2.11.15 |
| GHSA-jxxm-27vp-c3m5 NATS allows MQTT clients to bypass ACL checks |
Medium EPSS 0.26% |
>= 2.12.0-RC.1, < 2.12.6 | 2.12.6 |
| GHSA-jxxm-27vp-c3m5 NATS allows MQTT clients to bypass ACL checks |
Medium EPSS 0.26% |
< 2.11.15>= 2.12.0-RC.1, < 2.12.6 | 2.11.152.12.6 |
| GHSA-v722-jcv5-w7mc NATS has MQTT plaintext password disclosure |
High EPSS 0.37% |
< 2.11.15 | 2.11.15 |
| GHSA-v722-jcv5-w7mc NATS has MQTT plaintext password disclosure |
High EPSS 0.37% |
< 2.11.15>= 2.12.0-RC.1, < 2.12.6 | 2.11.152.12.6 |
| GHSA-v722-jcv5-w7mc NATS has MQTT plaintext password disclosure |
High EPSS 0.37% |
>= 2.12.0-RC.1, < 2.12.6 | 2.12.6 |
| GHSA-52jh-2xxh-pwh6 NATS Server panic via malicious compression on leafnode port |
High EPSS 0.68% |
< 2.11.14 | 2.11.14 |
| GHSA-52jh-2xxh-pwh6 NATS Server panic via malicious compression on leafnode port |
High EPSS 0.68% |
< 2.11.14>= 2.12.0-RC.1, < 2.12.5 | 2.11.142.12.5 |
| GHSA-52jh-2xxh-pwh6 NATS Server panic via malicious compression on leafnode port |
High EPSS 0.68% |
>= 2.12.0-RC.1, < 2.12.5 | 2.12.5 |
| GHSA-fcjp-h8cc-6879 NATS is vulnerable to MQTT hijacking via Client ID |
Medium EPSS 0.24% |
< 2.11.15 | 2.11.15 |
| GHSA-fcjp-h8cc-6879 NATS is vulnerable to MQTT hijacking via Client ID |
Medium EPSS 0.24% |
< 2.11.15>= 2.12.0-RC.1, < 2.12.6 | 2.11.152.12.6 |
| GHSA-fcjp-h8cc-6879 NATS is vulnerable to MQTT hijacking via Client ID |
Medium EPSS 0.24% |
>= 2.12.0-RC.1, < 2.12.6 | 2.12.6 |
| GHSA-x6g4-f6q3-fqvv NATS credentials are exposed in monitoring port via command-line argv |
Medium EPSS 0.43% |
< 2.11.15>= 2.12.0-RC.1, < 2.12.6 | 2.11.152.12.6 |
| GHSA-x6g4-f6q3-fqvv NATS credentials are exposed in monitoring port via command-line argv |
Medium EPSS 0.43% |
< 2.11.15 | 2.11.15 |
| GHSA-x6g4-f6q3-fqvv NATS credentials are exposed in monitoring port via command-line argv |
Medium EPSS 0.43% |
>= 2.12.0-RC.1, < 2.12.6 | 2.12.6 |
| GHSA-8m2x-3m6q-6w8j NATS: Message tracing can be redirected to arbitrary subject |
Medium EPSS 0.24% |
>= 2.12.0-preview.1, < 2.12.6 | 2.12.6 |
| GHSA-8m2x-3m6q-6w8j NATS: Message tracing can be redirected to arbitrary subject |
Medium EPSS 0.24% |
>= 2.11.0, < 2.11.15 | 2.11.15 |
| GHSA-8m2x-3m6q-6w8j NATS: Message tracing can be redirected to arbitrary subject |
Medium EPSS 0.24% |
>= 2.11.0, < 2.11.15>= 2.12.0-preview.1, < 2.12.6 | 2.11.152.12.6 |
| GHSA-qrvq-68c2-7grw nats-server websockets are vulnerable to pre-auth memory DoS |
High EPSS 0.55% |
< 2.11.12 | 2.11.12 |
| GHSA-qrvq-68c2-7grw nats-server websockets are vulnerable to pre-auth memory DoS |
High EPSS 0.55% |
< 2.11.12>= 2.12.0-RC.1, < 2.12.3 | 2.11.122.12.3 |
| GHSA-qrvq-68c2-7grw nats-server websockets are vulnerable to pre-auth memory DoS |
High EPSS 0.55% |
>= 2.12.0-RC.1, < 2.12.3 | 2.12.3 |
| GHSA-fhg8-qxh5-7q3w NATS Server may fail to authorize certain Jetstream admin APIs |
Critical EPSS 0.60% |
>= 2.2.0, < 2.10.27 | 2.10.27 |
| GHSA-fhg8-qxh5-7q3w NATS Server may fail to authorize certain Jetstream admin APIs |
Critical EPSS 0.60% |
>= 2.2.0, < 2.10.27>= 2.11.0, < 2.11.1 | 2.10.272.11.1 |
| GHSA-fhg8-qxh5-7q3w NATS Server may fail to authorize certain Jetstream admin APIs |
Critical EPSS 0.60% |
>= 2.11.0-RC.1, < 2.11.1 | 2.11.1 |
| GHSA-2h2x-8hh2-mfq8 NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects |
Medium EPSS 0.48% |
< 2.8.2 | 2.8.2 |
| GHSA-2h2x-8hh2-mfq8 NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects |
Medium EPSS 0.48% |
< 2.8.2 | 2.8.2 |
| GHSA-jj54-5q2m-q7pj NATS server TLS missing ciphersuite settings when CLI flags used |
Low | < 2.2.3 | 2.2.3 |
| GHSA-jj54-5q2m-q7pj NATS server TLS missing ciphersuite settings when CLI flags used |
Low | < 2.2.3 | 2.2.3 |
| GHSA-mr45-rx8q-wcm9 xkeys seal encryption used fixed key for all encryption |
High EPSS 0.45% |
>= 2.10.0, < 2.10.4 | 2.10.4 |
| GHSA-4frv-5fj6-4p25 Duplicate Advisory: NATS.io: Adding accounts for just the system account adds auth bypass Withdrawn |
Medium | >= 2.2.0, < 2.9.23 | 2.9.23 |
| GHSA-4frv-5fj6-4p25 Duplicate Advisory: NATS.io: Adding accounts for just the system account adds auth bypass Withdrawn |
Medium | >= 2.10.0, < 2.10.2 | 2.10.2 |
| GHSA-fr2g-9hjm-wr23 NATS.io: Adding accounts for just the system account adds auth bypass |
Medium EPSS 0.83% |
>= 2.2.0, < 2.9.23 | 2.9.23 |
| GHSA-fr2g-9hjm-wr23 NATS.io: Adding accounts for just the system account adds auth bypass |
Medium EPSS 0.83% |
>= 2.10.0, < 2.10.2 | 2.10.2 |
| GHSA-fr2g-9hjm-wr23 NATS.io: Adding accounts for just the system account adds auth bypass |
Medium EPSS 0.83% |
>= 2.2.0, < 2.9.23>= 2.10.0, < 2.10.2 | 2.9.232.10.2 |
| GO-2023-2066 NATS nats-server allows directory traversal via unintended path to a management action |
Critical EPSS 1.16% |
>= 2.2.0, < 2.7.4 | 2.7.4 |
| GHSA-6h3m-36w8-hv68 Arbitrary file write in nats-server |
Medium EPSS 2.34% |
>= 2.2.0, < 2.7.4 | 2.7.4 |
| GHSA-6h3m-36w8-hv68 Arbitrary file write in nats-server |
Medium EPSS 2.34% |
>= 2.2.0, < 2.7.4 | 2.7.4 |
| GHSA-m4jx-6526-vvhm Denial of service in github.com/nats-io/nats-server/server |
High EPSS 3.73% |
< 2.2.0 | 2.2.0 |
| GHSA-m4jx-6526-vvhm Denial of service in github.com/nats-io/nats-server/server |
High EPSS 3.73% |
< 2.2.0 | 2.2.0 |
| GHSA-g6w6-r76c-28j7 Incorrect Authorization in NATS nats-server |
High EPSS 1.33% |
>= 2.0.0, < 2.7.2 | 2.7.2 |
| GHSA-g6w6-r76c-28j7 Incorrect Authorization in NATS nats-server |
High EPSS 1.33% |
>= 2.0.0, < 2.7.2 | 2.7.2 |
| GHSA-9r5x-fjv3-q6h4 nats-io/jwt not enforcing checking of Import token permissions |
High EPSS 1.45% |
< 2.2.0 | 2.2.0 |
| GHSA-9r5x-fjv3-q6h4 nats-io/jwt not enforcing checking of Import token permissions |
High EPSS 1.45% |
< 2.2.0 | 2.2.0 |
| GHSA-gwj5-3vfq-q992 Import loops in account imports, nats-server DoS |
High | < 2.2.0 | 2.2.0 |
| GHSA-gwj5-3vfq-q992 Import loops in account imports, nats-server DoS |
High | < 2.2.0 | 2.2.0 |
| GHSA-hmm9-r2m2-qg9w Nil dereference in NATS JWT, DoS of nats-server |
High EPSS 2.16% |
< 2.1.9 | 2.1.9 |
| GHSA-2c64-vj8g-vwrq Incorrect handling of credential expiry by /nats-io/nats-server |
Critical EPSS 2.33% |
< 2.1.9 | 2.1.9 |
| GHSA-jp4j-47f9-2vc3 Integer Overflow or Wraparound in NATS Server |
High EPSS 1.77% |
< 2.2.0 | 2.2.0 |
| GHSA-jp4j-47f9-2vc3 Integer Overflow or Wraparound in NATS Server |
High EPSS 1.77% |
< 2.2.0 | 2.2.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor