CVE-2020-26149: Sensitive Data Exposure in NATS
Summary
CVE-2020-26149: Sensitive data exposure in NATS. Affects nats versions >= 2.0.0-201, < 2.0.0-209. Fixed in 2.0.0-209. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NATS is an open-source messaging system that provides lightweight and high-performance communication between distributed applications. It offers various client libraries for different programming languages, including nats.js, nats.ws, and nats.deno. These libraries enable developers to connect to a NATS server and exchange messages efficiently. However, certain versions of these libraries have a vulnerability that exposes sensitive data, including TLS private credentials, to the server. This flaw occurs due to the serialization and transmission of the entire connection configuration options to the server immediately after TLS establishment. The affected versions include nats.js beta branch versions from 2.0.0-201 to 2.0.0-209, nats.ws versions from 1.0.0-85 to 1.0.0-111, and all git tags prior to v1.0.0-9 in the nats.deno repository.
Vulnerability Detail
The vulnerability in the affected versions of the NATS libraries allows for the leakage of sensitive data from the client application to the server. Specifically, if the client is using TLS client certificates for mutual TLS authentication, the private key material for TLS is exposed to the server. This poses a significant security risk if the server is untrusted or if the client application disables TLS verification, as it allows an attacker with access to the server to obtain the client's authentication credentials. It is important to note that most authentication mechanisms are not affected by this vulnerability, except for TLS client certificates. NATS account NKey authentication is not impacted. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Latest published version: 2.29.3 as of 23 Oct 2026
npm install nats@2.29.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.0-209
This is the first release that contains the fix.
npm install nats@2.0.0-209Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the NATS libraries (nats.js, nats.ws, and nats.deno) in certain versions have a vulnerability that exposes sensitive data to the server. To mitigate this issue, it is crucial to update the affected libraries to the latest fixed versions. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nats →
FAQ
The vulnerability affects the beta branch of nats.js versions from 2.0.0-201 to 2.0.0-209. The mainline version is unaffected.
Yes, the vulnerability is present in nats.ws versions from 1.0.0-85 to 1.0.0-111 and all git tags prior to v1.0.0-9 in the nats.deno repository. However, the likelihood of applications using these clients leaking sensitive data is minimal.
No, NATS account NKey authentication is not affected by this vulnerability. Only TLS client certificates are impacted.
The impact of this vulnerability is the exposure of TLS private key material from the client application to the server. If the server is untrusted or the client application disables TLS verification, this can lead to the leakage of authentication credentials.
The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
References
Related vulnerabilities
Recent vulnerabilities recorded for nats.
