CVE-2020-28466: Denial of Service in github.com/nats-io/nats-server/server
Summary
CVE-2020-28466: Denial of service in github.com/nats-io/nats-server/server. Affects github.com/nats-io/nats-server versions < 2.2.0. Fixed in 2.2.0. How to fix ↓
Also tracked for
- nats · Bitnami
The same CVE-2020-28466 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/nats-io/nats-server/server is a Go package that provides a NATS server implementation. NATS is a lightweight and high-performance messaging system that is widely used in distributed systems. The server package is responsible for handling client connections, message routing, and other server-side functionalities. However, all versions of this package are vulnerable to a denial-of-service (DoS) attack when exposed to untrusted accounts.
Vulnerability Detail
The vulnerability allows untrusted accounts to crash the server by using configurations that represent service export/import cycles. This can lead to a complete disruption of the NATS service, rendering it unavailable to legitimate users. It is important to note that running a NATS service exposed to untrusted users presents a heightened risk. While fixes for denial-of-service issues with no threat of remote execution are likely to be committed to the main development branch, any remote execution flaw or equivalent seriousness will lead to prompt releases by the NATS maintainers.
How To Fix
Latest published version: v1.4.1 as of 22 Oct 2026
go get github.com/nats-io/nats-server@v1.4.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2.0
This is the first release that contains the fix.
go get github.com/nats-io/nats-server@v2.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users are encouraged to ensure that their NATS service is not exposed to untrusted accounts to minimize the risk of exploitation.
Conclusion
The vulnerability in the github.com/nats-io/nats-server/server package allows untrusted accounts to crash the NATS server, resulting in a denial-of-service condition. It is crucial to update to version 2.2.0 or later to mitigate this vulnerability. Restricting access to the NATS service and regularly building from the git repository are also recommended. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/nats-io/nats-server →
FAQ
The vulnerability allows untrusted accounts to crash the NATS server, resulting in a denial-of-service condition. This can lead to service disruption and unavailability for legitimate users.
No, remote code execution is not possible with this vulnerability. However, any remote execution flaw or equivalent seriousness will lead to prompt releases by the NATS maintainers.
Yes, all versions of the github.com/nats-io/nats-server/server package are affected by this vulnerability. It is recommended to update to version 2.2.0 or later.
Yes, restricting access to the NATS service and ensuring it is not exposed to untrusted accounts can help mitigate the risk of exploitation.
More information about this vulnerability can be found in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-m4jx-6526-vvhm/GHSA-m4jx-6526-vvhm.json
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/nats-io/nats-server.
