CVE-2020-26521: Nil dereference in NATS JWT, DoS of nats-server
Summary
CVE-2020-26521: Panic in NATS JWT decoding in github.com/nats-io/jwt. Affects github.com/nats-io/jwt versions < 1.1.0. Fixed in 1.1.0. How to fix ↓
Also tracked for
- github.com/nats-io/nats-server/v2 · Go
- golang-github-nats-io-jwt · Debian:12
The same CVE-2020-26521 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The NATS package is a Go library that provides support for the NATS messaging system. It includes a JWT library for handling JSON Web Tokens. The NATS server is a messaging server that utilizes the NATS package. The server allows the creation and signing of user accounts and JWTs. The operator, who is trusted by the servers, can issue accounts to other entities. However, a vulnerability in the JWT library allows a malicious account to create and sign a user JWT with a state not created by the normal tooling. This can lead to a nil dereference in the JWT library, causing the program to panic and abort execution. The NATS server is affected by this vulnerability, which can result in a denial of service (DoS) due to process termination.
Vulnerability Detail
The vulnerability arises from a nil dereference in the NATS JWT library. A malicious account can create a user JWT with an abnormal state, triggering a nil dereference when the JWT is decoded by the library. This causes the program to panic and terminate. The impact of this vulnerability is a DoS attack on the NATS server, as the process terminates unexpectedly. The JWT library itself also suffers from a nil dereference, resulting in program termination. The affected versions include all versions prior to 1.1.0 of the JWT library and version 2 prior to 2.1.9 of the NATS server.
How To Fix
Latest published version: v1.2.2 as of 23 Oct 2026
go get github.com/nats-io/jwt@v1.2.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.0
This is the first release that contains the fix.
go get github.com/nats-io/jwt@v1.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If the NATS servers do not trust any accounts managed by untrusted entities, the likelihood of encountering malformed user credentials is reduced. Therefore, if possible, it is recommended to ensure that only trusted accounts are used to minimize the risk of encountering this vulnerability.
Conclusion
In conclusion, the CVE-2020-26521 vulnerability in the NATS JWT library and NATS server can lead to a denial of service (DoS) attack. To mitigate this vulnerability, it is recommended to upgrade the JWT dependency to version 1.1.0 or later and upgrade the NATS server to version 2.1.9 or later. If the NATS servers do not trust untrusted accounts, the risk of encountering this vulnerability is reduced. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/nats-io/jwt →
FAQ
The impact of this vulnerability is a denial of service (DoS) attack on the NATS server, as the process terminates unexpectedly.
The affected versions include all versions prior to 1.1.0 of the JWT library and version 2 prior to 2.1.9 of the NATS server.
To fix this vulnerability, upgrade the JWT dependency to version 1.1.0 or later in any application using it. If the NATS server is being used, upgrade it to version 2.1.9 or later.
If the NATS servers do not trust any accounts managed by untrusted entities, the likelihood of encountering malformed user credentials is reduced.
You can find more information about this vulnerability in the GitHub Advisory Database.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/nats-io/jwt.
