CVE-2020-26521: Nil dereference in NATS JWT, DoS of nats-server
Summary
CVE-2020-26521: Nil dereference in NATS JWT, DoS of nats-server. Affects github.com/nats-io/jwt versions < 1.1.0. Fixed in 1.1.0. How to fix ↓
Also tracked for
- github.com/nats-io/nats-server/v2 · Go
- golang-github-nats-io-jwt · Debian:12
The same CVE-2020-26521 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The NATS package is a Go library that provides support for the NATS messaging system. It includes a JWT library for handling authentication and authorization. The NATS server is a lightweight and high-performance messaging system that uses the NATS protocol. The server supports the use of JWTs for authentication and authorization. However, a vulnerability has been discovered in the JWT library and the NATS server that allows for a denial of service (DoS) attack.
Vulnerability Detail
The vulnerability arises from a nil dereference issue in the NATS JWT library. When decoding a User JWT with a state that was not created by the normal tooling, the library attempts a nil dereference, causing the program to panic and abort execution. This vulnerability can be exploited by a malicious account to create and sign a User JWT with a specially crafted state. The impact of this vulnerability is a DoS attack on the NATS server, as the process terminates due to the panic.
How To Fix
Latest published version: v1.2.2 as of 23 Oct 2026
go get github.com/nats-io/jwt@v1.2.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.0
This is the first release that contains the fix.
go get github.com/nats-io/jwt@v1.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If your NATS servers do not trust any accounts managed by untrusted entities, the likelihood of encountering malformed User credentials is low. Therefore, ensuring that your NATS servers only trust accounts from trusted entities can serve as a workaround for this vulnerability.
Conclusion
The CVE-2020-26521 vulnerability in the NATS JWT library and NATS server can lead to a denial of service (DoS) attack. To mitigate this vulnerability, it is crucial to upgrade the JWT dependency to version 1.1.0 or later and upgrade the NATS server to version 2.1.9 or later. If you have further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/nats-io/jwt →
FAQ
The impact of this vulnerability is a denial of service (DoS) attack on the NATS server, as the process terminates due to the panic caused by the nil dereference.
The JWT library is affected in all versions prior to 1.1.0. The NATS server is affected in version 2 prior to 2.1.9.
To mitigate the risk, it is recommended to upgrade the JWT dependency to version 1.1.0 or later and upgrade the NATS server to version 2.1.9 or later.
Yes, if your NATS servers do not trust any accounts managed by untrusted entities, the likelihood of encountering malformed User credentials is low, serving as a workaround.
You can find more information about this vulnerability in the GitHub Advisory Database. The link is provided in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/nats-io/jwt.
