VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/nats-io/nats-server: vulnerability history, versions and safety

github.com/nats-io/nats-server is a package in the Go ecosystem. Vulert records 24 vulnerabilities for it across 120 releases, from Feb 2022 to Mar 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
24 vulnerabilities recorded C1 H1 U22
i
22 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
14 in the last 12 months

Most recent disclosure 26 Mar 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/nats-io/nats-server vulnerabilities

Vulert verdict on github.com/nats-io/nats-server v1.4.1 i

Updated on 23 Oct 2026

Careful: v1.4.1 has 23 known vulnerabilities, and 22 have no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 50/100
  • Security Unfixed issues
  • Maintenance Slowing
  • Popularity Key ecosystem project
  • Community Active

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v1.4.1 — affected i
  • Vulnerabilities on record 24 over 4 years · 14 in the last year i
  • Latest disclosure 26 Mar 2026 i
  • Highest CVSS 9.8 i
  • With no published fix 22 i
  • Stars 20,880 i
  • OpenSSF scorecard 7/10 i
  • Last release 92 months ago i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 22 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/nats-io/nats-server, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v1.3.1-0.20190602020606-7f7fe225e032 02 Jun 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190601234354-2a8e630bf13c 01 Jun 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190601000742-9bb357e32a26 01 Jun 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190531235827-adba6dc02386 31 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190531182933-d246359dc88d 31 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190531182202-3cf6f6a5d2a4 31 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190531010902-cba2462a7720 31 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190531004301-37f4e7124636 31 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190530232405-1c193452b1ee 30 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190530232115-37b3546e7be5 30 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190530230436-c188cb092c10 30 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190530225314-257b670ae2f1 30 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190530224001-eeffab25dbe4 30 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190530222537-451d4bb05c46 30 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190530213940-d935b3d77122 30 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190530213035-da938dcb1e21 30 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190530212439-437e16ca71a7 30 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190530173438-14ade43da93e 30 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190530171752-376eee46e9b8 30 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190530161520-42a7797a50d4 30 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190529212058-eb6689143d23 29 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190529211631-44554057d180 29 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190529210051-a94fe78c22d5 29 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190529210049-8b78b97a67f6 29 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190529202826-7f2620904c0a 29 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190529201958-874f06a2128f 29 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190529003348-33505e4849ad 29 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190528231725-bd589fb20cea 28 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190528213306-66f5325cee91 28 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190528205729-f5991e8a2bce 28 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190528205545-2d4c3dd38f2e 28 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190528185615-fed8ee08578e 28 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190528184109-5478eaf01ea1 28 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190527002306-4ed08dde0723 27 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190527001627-a16a53441af8 27 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190526235101-d2578f9e05a7 26 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190526231708-ce1e6defab96 26 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190525222700-b325cf1e4afb 25 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190524204337-7e11b982aa99 24 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190524202156-a3996cbd2946 24 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190524194241-55597a7e8b9d 24 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190524160814-795c1cf9cc45 24 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190524155335-48c3f7f8465c 24 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190522200713-d779a0bd38a5 22 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190522185847-614240178c45 22 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190522184023-68e3fb634480 22 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190522183116-97ee89cc67d8 22 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190522131151-698d9e642c5d 22 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190522075925-f960378487c4 22 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190522005201-32b95a2f281f 22 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190521222842-933f5d0df4ac 21 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190521221231-67bb08af8b9b 21 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190521191332-c00226af3ee0 21 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190521185934-ecfd1a2c85ab 21 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190521183715-8a614b49e15f 21 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190521162334-19ef4e47a37c 21 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190521152859-1cdc3eb41f35 21 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190521143513-0144e27afdf0 21 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190520222848-7272e4e3172f 20 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190520165252-36fd47df5d02 20 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190520161356-03930ba0e40c 20 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190516215629-25cd64b89184 16 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190516213444-164a9abcc21e 16 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190516150626-9e2107c860a4 16 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190513201630-031276c22e7f 13 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190513194419-21d6875b6eb3 13 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190513183234-565efbbbc4ec 13 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190513182443-edf0e39b62cd 13 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190513174929-1eff7bc11202 13 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190513172947-616b840cace8 13 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190510223348-a0c9907ec021 10 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190510221130-d7140a0fd1ee 10 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190510011331-da9120345c83 10 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190510011229-034a9fd1e4bf 10 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190510002517-042e5a539a11 10 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190509220606-19bb4863fbf9 09 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190509203304-c01421131872 09 May 2019 H1 U22 Apache-2.0 No Details →
v0.0.0-20190506224138-6584a9a8283f 06 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190506224138-6584a9a8283f 06 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190506221511-60978531eeb1 06 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190506220958-3784bddd988d 06 May 2019 H1 U22 Apache-2.0 No Details →
v0.0.0-20190506220424-acfe372d6353 06 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190506220424-acfe372d6353 06 May 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190410001831-064b3441cce4 10 Apr 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190409233753-4dd1b26cc559 09 Apr 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190409232410-58b21e392c8e 09 Apr 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190409230715-031267dfd6fe 09 Apr 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190409224137-44fc27f1d015 09 Apr 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190409223319-515ca5e70fe4 09 Apr 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190408200341-98161722dcb3 08 Apr 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190408195723-a6aeed3a6b35 08 Apr 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190408172951-c191eadc41a0 08 Apr 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190408165439-6b1918efb46e 08 Apr 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190326232133-2a86112a30f9 26 Mar 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190326171831-9daf6427eadd 26 Mar 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190326165053-25f51884a24d 26 Mar 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190325221511-19c4ccecb87d 25 Mar 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190325210452-81eb065391da 25 Mar 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190325200434-540b9be8e513 25 Mar 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190325191017-499f67ff287f 25 Mar 2019 H1 U22 Apache-2.0 No Details →
v1.3.1-0.20190325184822-92f9f7ed56fd 25 Mar 2019 H1 U22 — No Details →
v1.3.1-0.20190325155447-bacb73a4032c 25 Mar 2019 H1 U22 — No Details →
v1.3.1-0.20190322151419-2ea470a963e3 22 Mar 2019 H1 U22 — No Details →
v1.3.1-0.20190322143943-394bddb6f4a5 22 Mar 2019 H1 U22 — No Details →
v1.3.1-0.20190321164601-b804870e1236 21 Mar 2019 H1 U22 — No Details →
v1.3.1-0.20190320214517-65cc218cba13 20 Mar 2019 H1 U22 — No Details →
v1.3.1-0.20190311222832-8ba3abef6ac9 11 Mar 2019 H1 U22 — No Details →
v1.3.1-0.20190311212518-04deabf27d20 11 Mar 2019 H1 U22 — No Details →
v1.3.1-0.20190311204822-83aefdc71449 11 Mar 2019 H1 U22 — No Details →
v1.3.1-0.20190307043746-c6259709090e 07 Mar 2019 H1 U22 — No Details →
v1.3.1-0.20190307000549-7da8861e4906 07 Mar 2019 H1 U22 — No Details →
v1.3.1-0.20190228211409-0255390f8073 28 Feb 2019 H1 U22 — No Details →
v1.3.1-0.20190228210153-3e24d70ea471 28 Feb 2019 H1 U22 — No Details →
v1.3.1-0.20190228181605-ba748302c4c7 28 Feb 2019 H1 U22 — No Details →
v1.3.1-0.20190227020949-02d6d9f512d3 27 Feb 2019 H1 U22 — No Details →
v1.3.1-0.20190227013430-18399a38082d 27 Feb 2019 H1 U22 — No Details →
v1.3.1-0.20190225062007-f68f9b106093 25 Feb 2019 H1 U22 — No Details →
v1.3.1-0.20190225061923-c783d56c48b7 25 Feb 2019 H1 U22 — No Details →
v1.3.1-0.20190225055638-566d29d01e26 25 Feb 2019 H1 U22 — No Details →
v1.3.1-0.20190225055003-d26323cb0ff4 25 Feb 2019 H1 U22 — No Details →

The newest 120 of 1,749 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2022 1
  • 2023 1
  • 2024 8
  • 2026 14

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 14 of the 24 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/nats-io/nats-server

The 5 most severe of 24 vulnerabilities recorded for this package

Search all 24 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2022-28357: Directory Traversal Vulnerability in NATS nats-server 9.8 critical 2.7.4 19 Sep 2023
CVE-2020-28466: Denial of Service in github.com/nats-io/nats-server/server 7.5 high 2.2.0 15 Feb 2022
CVE-2026-27889: NATS Server WebSocket Frame Length Overflow Vulnerability N/A unrated No fix published 26 Mar 2026
CVE-2026-33247: NATS Server Exposes Credentials via Monitoring Port N/A unrated No fix published 26 Mar 2026
CVE-2026-33249: NATS Server Message Tracing Vulnerability Leading to Arbitrary Subject Redirection N/A unrated No fix published 26 Mar 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/nats-io/nats-server

Is github.com/nats-io/nats-server safe to use?

Vulert records 24 vulnerabilities for github.com/nats-io/nats-server in Go: 1 critical, 1 high, 0 medium and 0 low, plus 22 not yet rated. 22 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/nats-io/nats-server's Vulert package health score?

Vulert scores github.com/nats-io/nats-server 50/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of github.com/nats-io/nats-server affected?

Yes. v1.4.1, the version you would install today, has 23 known vulnerabilities, and 22 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

Which version of github.com/nats-io/nats-server should I use?

v1.4.1 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/nats-io/nats-server have?

24 vulnerabilities are recorded for github.com/nats-io/nats-server in the Go ecosystem: 1 critical, 1 high, 0 medium and 0 low, plus 22 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/nats-io/nats-server vulnerabilities disclosed?

14 vulnerabilities were recorded for github.com/nats-io/nats-server in the last 12 months, and the oldest entry in this database dates to 15 Feb 2022. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/nats-io/nats-server are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/nats-io/nats-server for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/nats-io/nats-server version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.