CVE-2020-26892: Incorrect handling of credential expiry by NATS Server
Summary
CVE-2020-26892: Incorrect handling of credential expiry by /nats-io/nats-server. Affects github.com/nats-io/jwt versions < 1.1.0. Fixed in 1.1.0. How to fix ↓
Also tracked for
- github.com/nats-io/nats-server/v2 · Go
- golang-github-nats-io-jwt · Debian:12
The same CVE-2020-26892 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The NATS Server is an open-source messaging system that provides a lightweight and high-performance communication platform for distributed systems. It uses the NATS accounts system, which includes a JWT library for handling credentials and authentication. However, prior to version 1.1.0 of the JWT library and version 2.1.9 of the NATS Server, there was an incorrect handling of credential expiry, leading to a vulnerability.
Vulnerability Detail
The vulnerability arises from the misuse of the JWT library's API and the IsRevoked() method. The library's API encouraged misuse, and the IsRevoked() method misused its own API. As a result, time-based credential expiry did not work as intended. An attacker could exploit this vulnerability to bypass credential expiry and gain unauthorized access to the NATS Server. The impact of this vulnerability is critical, as it compromises the security and integrity of the messaging system.
How To Fix
Latest published version: v1.2.2 as of 23 Oct 2026
go get github.com/nats-io/jwt@v1.2.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.0
This is the first release that contains the fix.
go get github.com/nats-io/jwt@v1.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate fixes cannot be deployed, a workaround is to use credentials that only expire after the necessary updates have been applied. This ensures that the vulnerability is not exploitable until the system can be properly secured.
Conclusion
The incorrect handling of credential expiry in the NATS Server poses a critical vulnerability that can be exploited to gain unauthorized access. To mitigate this risk, it is crucial to upgrade the JWT dependency and the NATS Server to the recommended versions. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for github.com/nats-io/jwt →
FAQ
The impact is critical, as it allows attackers to bypass credential expiry and gain unauthorized access to the NATS Server.
Upgrade the JWT dependency to version 1.1.0 or later and upgrade the NATS Server to version 2.1.9 or later.
Yes, you can use credentials that only expire after the necessary updates have been applied.
All versions prior to 1.1.0 are affected.
Versions 2.0.0 through 2.1.8 are affected.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/nats-io/jwt.
