Is github.com/hashicorp/nomad safe to use?

Vulert records 68 vulnerabilities for github.com/hashicorp/nomad in Go: 3 critical, 13 high, 16 medium and 2 low, plus 34 not yet rated. 2 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/hashicorp/nomad's Vulert package health score?

Vulert scores github.com/hashicorp/nomad 74/100, which reads as in good shape. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Which version of github.com/hashicorp/nomad should I use?

v1.11.3 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/hashicorp/nomad have?

68 vulnerabilities are recorded for github.com/hashicorp/nomad in the Go ecosystem: 3 critical, 13 high, 16 medium and 2 low, plus 34 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/hashicorp/nomad vulnerabilities disclosed?

5 vulnerabilities were recorded for github.com/hashicorp/nomad in the last 12 months, and the oldest entry in this database dates to 18 May 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/hashicorp/nomad are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/hashicorp/nomad for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at https://vulert.com/scanner and Vulert keeps checking the github.com/hashicorp/nomad version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.

Vulnerability Database · Go · Package report

github.com/hashicorp/nomad: vulnerability history, versions and safety

github.com/hashicorp/nomad is a package in the Go ecosystem. Vulert records 68 vulnerabilities for it across 120 releases, from May 2021 to Jun 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

68 vulnerabilities recorded C3 H13 M16 L2 U34

2 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →

5 in the last 12 months

Most recent disclosure 25 Jun 2026.

See the disclosure history →

0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/hashicorp/nomad vulnerabilities

Vulert verdict on github.com/hashicorp/nomad v1.11.3 i

Updated on 23 Oct 2026

Careful: 2 of the 68 vulnerabilities Vulert records for this package have no fix yet. Plan around those, or apply the workaround listed for each. The rest have a fixed version to move to.

Package health score 74/100

Security Unfixed issues
Maintenance Sustainable
Popularity Key ecosystem project
Community Active

What to do: Plan around the 2 vulnerabilities with no published fix: each lists the affected range and any workaround that reduces exposure. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

Current release v1.11.3 — unaffected i
Vulnerabilities on record 68 over 5 years · 5 in the last year i
Latest disclosure 25 Jun 2026 i
Highest CVSS 9.8 i
With no published fix 2 i
Stars 17,023 i
OpenSSF scorecard 7/10 i
Last release this month i
Licence MPL-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 22 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

Scan your app free →

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/hashicorp/nomad, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

Version	Released	Vulert vulnerabilities	Licence	Fix published	Details
v0.0.0-20261021233103-cd3e55df2c8e	21 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20261021233103-cd3e55df2c8e	21 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20261020180939-fd2b0dea13c7	20 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20261020180939-fd2b0dea13c7	20 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20261020154844-69097488a0fe	20 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20261020154844-69097488a0fe	20 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20261020144131-6ba49752658f	20 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20261020144131-6ba49752658f	20 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20261020124059-9d4576f1dd66	20 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20261020124059-9d4576f1dd66	20 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20261019220203-6ad1f913fa50	19 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20261019220203-6ad1f913fa50	19 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20261016150620-df630b26e78a	16 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20261016150620-df630b26e78a	16 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20261015175607-0c8fe412fab2	15 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20261015175607-0c8fe412fab2	15 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20261015124312-e993465c5a6b	15 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20261015124312-e993465c5a6b	15 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20261013065900-bf24b0dd9743	13 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20261013065900-bf24b0dd9743	13 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20261012160943-9f90f8838c89	12 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20261012160943-9f90f8838c89	12 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20261012141846-18b85f68c7b9	12 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20261012141846-18b85f68c7b9	12 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20261009174508-802823357fba	09 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20261009174508-802823357fba	09 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20261007123744-e37365bc23fa	07 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20261007123744-e37365bc23fa	07 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20261007064340-b1e9965dd229	07 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20261006141433-65a1c427bb3a	06 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20261006141433-65a1c427bb3a	06 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20261006130447-3d9e0688659b	06 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20261006130447-3d9e0688659b	06 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20261005160421-04af70ce00ae	05 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20261005160421-04af70ce00ae	05 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20261005135124-4cf0f2371378	05 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20261005131446-84559c2feb5e	05 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20261005131446-84559c2feb5e	05 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20261005062230-f09f6df326b4	05 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20261005062230-f09f6df326b4	05 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20261001163103-3a9af341c94e	01 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20261001163103-3a9af341c94e	01 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20261001080452-5948bb9aedb0	01 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20261001080452-5948bb9aedb0	01 Oct 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260930154822-c917ac0a932e	30 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20260930154822-c917ac0a932e	30 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260930123148-ed15f7b1ece7	30 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20260930123148-ed15f7b1ece7	30 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260929131605-36bc0fce3dbd	29 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20260929131605-36bc0fce3dbd	29 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260929122401-a96b52881c91	29 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260929114848-0202432502fb	29 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20260929114848-0202432502fb	29 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260924191603-3f304768e47b	24 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20260924191603-3f304768e47b	24 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260924145634-6984884ff2d5	24 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20260924145634-6984884ff2d5	24 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260924124507-862114e0ecaa	24 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260923175600-96dffc5a3e4f	23 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20260923175600-96dffc5a3e4f	23 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260923095306-73804ff45659	23 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20260923095306-73804ff45659	23 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260923080553-3ad114d60d01	23 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20260923080553-3ad114d60d01	23 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260923071917-f742bae15efe	23 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260922135024-0afeddadd9b4	22 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20260922135024-0afeddadd9b4	22 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260922101347-4badfc242423	22 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20260922101347-4badfc242423	22 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260921181219-70519e8467e4	21 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20260921181219-70519e8467e4	21 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260921134951-9e1409fc523a	21 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20260921134951-9e1409fc523a	21 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260918231636-2aff4fe54d0f	18 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20260918231636-2aff4fe54d0f	18 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260918215222-ffa5215040be	18 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260918162627-7719cd19dae6	18 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20260918162627-7719cd19dae6	18 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260918151345-83cbef2d0323	18 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20260918151345-83cbef2d0323	18 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260917172403-9dcbdc5e64ec	17 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20260917172403-9dcbdc5e64ec	17 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260916201249-aba089c4fa1c	16 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20260916201249-aba089c4fa1c	16 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260916125254-0cbec7212173	16 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20260916125254-0cbec7212173	16 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260915175742-d94c05b44c1a	15 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20260915175742-d94c05b44c1a	15 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260915143722-93e2b533adf6	15 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20260915143722-93e2b533adf6	15 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260915124045-2fe43613f238	15 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20260915124045-2fe43613f238	15 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260914165401-f0cddace3aa2	14 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20260914165401-f0cddace3aa2	14 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260914134528-f5204745fc70	14 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260911180102-25ec37bd0589	11 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20260911180102-25ec37bd0589	11 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260911152051-78a977b1ecd3	11 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260911132418-88a99b071c01	11 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v1.11.0-rc.1.0.20260911132418-88a99b071c01	11 Sep 2026	H7 M6 U15	MPL-2.0	No	Details →
v0.0.0-20260911130338-179062bfe3b9	11 Sep 2026	H7 M6 U15	—	No	Details →
v1.11.0-rc.1.0.20260911130338-179062bfe3b9	11 Sep 2026	H7 M6 U15	—	No	Details →
v0.0.0-20260911121300-1327c26407d6	11 Sep 2026	H7 M6 U15	—	No	Details →
v1.11.0-rc.1.0.20260911121300-1327c26407d6	11 Sep 2026	H7 M6 U15	—	No	Details →
v0.0.0-20260910221047-72bd1d107f23	10 Sep 2026	H7 M6 U15	—	No	Details →
v1.11.0-rc.1.0.20260910221047-72bd1d107f23	10 Sep 2026	H7 M6 U15	—	No	Details →
v0.0.0-20260910131935-17672e5193bd	10 Sep 2026	H7 M6 U15	—	No	Details →
v1.11.0-rc.1.0.20260910131935-17672e5193bd	10 Sep 2026	H7 M6 U15	—	No	Details →
v0.0.0-20260909213452-ae756757bf7e	09 Sep 2026	H7 M6 U15	—	No	Details →
v1.11.0-rc.1.0.20260909213452-ae756757bf7e	09 Sep 2026	H7 M6 U15	—	No	Details →
v0.0.0-20260909212617-624f9f2ba861	09 Sep 2026	H7 M6 U15	—	No	Details →
v0.0.0-20260909172256-f74ce32f7004	09 Sep 2026	H7 M6 U15	—	No	Details →
v1.11.0-rc.1.0.20260909172256-f74ce32f7004	09 Sep 2026	H7 M6 U15	—	No	Details →
v0.0.0-20260909062153-1a11b7925a71	09 Sep 2026	H7 M6 U15	—	No	Details →
v1.11.0-rc.1.0.20260909062153-1a11b7925a71	09 Sep 2026	H7 M6 U15	—	No	Details →
v0.0.0-20260908145620-9d52ef0f3ce6	08 Sep 2026	H7 M6 U15	—	No	Details →
v1.11.0-rc.1.0.20260908145620-9d52ef0f3ce6	08 Sep 2026	H7 M6 U15	—	No	Details →
v0.0.0-20260907080526-08ef8f3d26da	07 Sep 2026	H7 M6 U15	—	No	Details →
v1.11.0-rc.1.0.20260907080526-08ef8f3d26da	07 Sep 2026	H7 M6 U15	—	No	Details →
v0.0.0-20260904223745-78e9d2aa0cc8	04 Sep 2026	H7 M6 U15	—	No	Details →

The newest 120 of 13,029 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

2021 6
2022 12
2023 7
2024 34
2025 4
2026 5

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 5 of the 68 were recorded in the last 12 months.

Other ways into the data

03 Vulnerabilities

Recorded vulnerabilities for github.com/hashicorp/nomad

Vulnerability	Severity	Fixed version ↓	Disclosed ↓
CVE-2019-12618: Hashicorp Nomad Access Control Issues	9.8 critical	0.9.2	24 May 2022
CVE-2022-30324: Privilege escalation in Hashicorp Nomad	9.8 critical	1.1.14	03 Jun 2022
CVE-2020-7956: Improper Certificate Validation in HashiCorp Nomad	9.8 high	0.10.3	18 May 2021
CVE-2020-27195: Use After Free in HashiCorp Nomad	9.1 critical	0.10.6	15 Feb 2022
CVE-2023-1782: HashiCorp Nomad Unauthenticated Client Agent HTTP Request Privilege Escalation	8.8 high	1.5.3	05 Apr 2023

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315