VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/nats-io/nats-server/v2: vulnerability history, versions and safety

github.com/nats-io/nats-server/v2 is a package in the Go ecosystem. Vulert records 28 vulnerabilities for it across 120 releases, from May 2021 to Mar 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
28 vulnerabilities recorded C1 H14 M9 L2 U2
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
14 in the last 12 months

Most recent disclosure 25 Mar 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/nats-io/nats-server/v2 vulnerabilities

Vulert verdict on github.com/nats-io/nats-server/v2 v2.15.1 i

Updated on 23 Oct 2026

Action needed: v2.15.1 has 19 known vulnerabilities, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 69/100
  • Security Unfixed issues
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Active

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v2.15.1 — affected i
  • Vulnerabilities on record 28 over 4 years · 14 in the last year i
  • Latest disclosure 25 Mar 2026 i
  • Highest CVSS 9.6 i
  • With no published fix 0 i
  • Stars 20,917 i
  • OpenSSF scorecard 7/10 i
  • Last release this month i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/nats-io/nats-server/v2, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v2.15.1-0.20261020092952-f8f6db894528 20 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20261015061627-b55d969381aa 15 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20261009162753-64dda80fdd87 09 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20261009133209-df8920e046d6 09 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20261009091014-7227b6f789e2 09 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20261009085018-5b59703d8f23 09 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.14.8 09 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1 09 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20261008165238-6af2d22525d5 08 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20261008084745-b31b7b61df2a 08 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20261007141146-7f6b195c6c9b 07 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20261007112858-eed238891948 07 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20261007111656-79da9d82f1b8 07 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20261007091623-67af1000ea8e 07 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20261006165851-89832812804a 06 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.14.8-RC.2 06 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-RC.2 06 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20261006090712-caf125fd065f 06 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20261005160711-24b40f106d0a 05 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20261005123724-10887cdf03a6 05 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20261005100455-40c011380c32 05 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20261005083550-9aead5b1d259 05 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20261002145016-c4eb4fc36b73 02 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20261002110720-81dcb3ba7bd6 02 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20261002085341-8d3205d92293 02 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20261001163612-a44c356c4271 01 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20261001155416-208e72bd0d64 01 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20261001143625-224f0ba2e6e4 01 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20261001124759-f56152f07827 01 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20261001114340-5f0936e115c3 01 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20261001110846-2d6456881ad8 01 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20261001101251-667a5b55a3a8 01 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20261001084854-49fdfaeee220 01 Oct 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20260930145203-e967f300128a 30 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20260930131636-0f57225563ed 30 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20260930125259-9df443af6ae0 30 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20260930091531-19c219798201 30 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.14.8-RC.1 28 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-RC.1 28 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20260928154846-aabc8b3928bf 28 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20260928094950-60b9679caa46 28 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20260925155757-3e8ddaa7fcdf 25 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20260925101649-0c763dc64cb6 25 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20260924140210-eb6f3a8c5786 24 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20260924093443-7c4fdd8c040e 24 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20260923155959-375492dca0ed 23 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20260923144135-e778a57ea754 23 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20260923094732-af259718fcbb 23 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20260923084404-07a1a1e66bb4 23 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20260922122241-edb1b17a76f1 22 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20260922093908-2efc8a4ee902 22 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20260921145338-9c9ee0536976 21 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20260921135320-4824560f62ca 21 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20260921120307-80a50c27de95 21 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20260921103101-a9af919e1d09 21 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20260921100203-658769bfa2f7 21 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20260921095948-39cfef68e242 21 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20260918153739-8ad52657d1f3 18 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20260918134957-16186dd90787 18 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20260918123621-799588f1e300 18 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20260918091549-c579fd14410e 18 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20260917135200-5986d8a1b7b3 17 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.1-0.20260917123010-2ca02b801f3b 17 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.0 17 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.0-RC.2.0.20260917102917-8f3f31b0366e 17 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.0-RC.2.0.20260916125921-8a5b1a8a87a5 16 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.0-RC.2.0.20260915160713-dfe94468ac6c 15 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.0-RC.2 15 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.0-RC.1.0.20260915155757-fc7643f77f24 15 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.14.7 15 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.0-RC.1.0.20260915100748-c6612db3d179 15 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.14.7-RC.2 14 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.0-RC.1.0.20260914130015-973e238eaed7 14 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.0-RC.1.0.20260914102132-b421282dc6c2 14 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.0-RC.1.0.20260911143315-3c80d8f89eac 11 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.0-RC.1.0.20260911125824-42003c19ba0c 11 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.0-RC.1.0.20260911112725-5f1e742c7fc2 11 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.14.7-RC.1 10 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.0-RC.1.0.20260910134414-9d49ea2f8b5f 10 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.0-RC.1.0.20260909093633-3ad37644ae68 09 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.0-RC.1.0.20260909083353-8003006632d6 09 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.0-RC.1.0.20260908104918-61b9774786c7 08 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.0-RC.1.0.20260908085120-4fc5a3543d54 08 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.0-RC.1.0.20260907154231-622457b6dfd5 07 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.15.0-RC.1 07 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.14.1-0.20260907150325-fc98a8951dea 07 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.14.1-0.20260907142734-d4bed50270a4 07 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.14.1-0.20260907122523-2290bb84e834 07 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.14.1-0.20260907112332-1b1b1720457c 07 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.14.1-0.20260907100525-d21b8e449761 07 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.14.1-0.20260904102036-8e3793e3dca3 04 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.14.1-0.20260904095237-95791cb261b8 04 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.14.1-0.20260903155406-36c95935adb1 03 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.14.1-0.20260903154231-9da13afe5309 03 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.14.1-0.20260903150525-b1fe90c671d4 03 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.14.1-0.20260903123241-6dbb55f66ad6 03 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.14.1-0.20260903105811-f4650c338c41 03 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.14.1-0.20260903095859-99a7fec5c2da 03 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.14.1-0.20260903092252-1c7ae39a7063 03 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.14.1-0.20260902165734-6cb77b9f30d3 02 Sep 2026 H10 M7 L2 Apache-2.0 Yes Details →
v2.14.1-0.20260902155327-40cdcffe4b48 02 Sep 2026 H10 M7 L2 — Yes Details →
v2.14.1-0.20260902145947-638fec891806 02 Sep 2026 H10 M7 L2 — Yes Details →
v2.14.1-0.20260902110859-89b11f880ad7 02 Sep 2026 H10 M7 L2 — Yes Details →
v2.14.1-0.20260902093001-8595d5f55f8b 02 Sep 2026 H10 M7 L2 — Yes Details →
v2.14.1-0.20260902085852-2ec24005790c 02 Sep 2026 H10 M7 L2 — Yes Details →
v2.14.1-0.20260901162357-3a66a489d262 01 Sep 2026 H10 M7 L2 — Yes Details →
v2.14.1-0.20260901155936-ee2957a95338 01 Sep 2026 H10 M7 L2 — Yes Details →
v2.14.1-0.20260901085940-71a4de8be359 01 Sep 2026 H10 M7 L2 — Yes Details →
v2.14.1-0.20260831154453-6a2e21bc13b0 31 Aug 2026 H10 M7 L2 — Yes Details →
v2.14.1-0.20260828092420-6f3d85d56d70 28 Aug 2026 H10 M7 L2 — Yes Details →
v2.14.1-0.20260828085348-90d05d6433be 28 Aug 2026 H10 M7 L2 — Yes Details →
v2.14.1-0.20260827164451-34d3f9b4d199 27 Aug 2026 H10 M7 L2 — Yes Details →
v2.14.6 27 Aug 2026 H10 M7 L2 — Yes Details →
v2.14.1-0.20260827085234-6fb4c1958f6c 27 Aug 2026 H10 M7 L2 — Yes Details →
v2.14.1-0.20260826163346-b1ac5e0bb262 26 Aug 2026 H10 M7 L2 — Yes Details →
v2.14.6-RC.2 26 Aug 2026 H10 M7 L2 — Yes Details →
v2.14.1-0.20260826130636-8a68882143f4 26 Aug 2026 H10 M7 L2 — Yes Details →
v2.14.1-0.20260826114533-999162eb6d50 26 Aug 2026 H10 M7 L2 — Yes Details →
v2.14.1-0.20260826104411-e3f5f8b493d5 26 Aug 2026 H10 M7 L2 — Yes Details →
v2.14.1-0.20260826103042-28aea76acf3d 26 Aug 2026 H10 M7 L2 — Yes Details →

The newest 120 of 7,324 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2021 5
  • 2022 2
  • 2023 3
  • 2024 2
  • 2025 2
  • 2026 14

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 14 of the 28 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/nats-io/nats-server/v2

The 5 most severe of 28 vulnerabilities recorded for this package

Search all 28 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2025-30215: NATS Server Critical JetStream API Authorization Bypass 9.6 critical 2.11.1 15 Apr 2025
CVE-2022-24450: Incorrect Authorization in NATS nats-server 8.8 high 2.7.2 08 Feb 2022
CVE-2026-33216: NATS Server MQTT Plaintext Password Disclosure Vulnerability 8.6 high 2.11.15 24 Mar 2026
Import Loops in Account Imports, nats-server DoS - Vulnerability in github.com/nats-io/nats-server/v2 7.5 low 2.2.0 21 May 2021
Nil dereference in NATS JWT, DoS of nats-server 7.5 high 2.1.9 21 May 2021

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/nats-io/nats-server/v2

Is github.com/nats-io/nats-server/v2 safe to use?

Vulert records 28 vulnerabilities for github.com/nats-io/nats-server/v2 in Go: 1 critical, 14 high, 9 medium and 2 low, plus 2 not yet rated. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is github.com/nats-io/nats-server/v2's Vulert package health score?

Vulert scores github.com/nats-io/nats-server/v2 69/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/nats-io/nats-server/v2 affected?

Yes. v2.15.1, the version you would install today, has 19 known vulnerabilities, and every one of them has a published fix. Upgrade to the version listed for each.

Which version of github.com/nats-io/nats-server/v2 should I use?

v2.15.1 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/nats-io/nats-server/v2 have?

28 vulnerabilities are recorded for github.com/nats-io/nats-server/v2 in the Go ecosystem: 1 critical, 14 high, 9 medium and 2 low, plus 2 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/nats-io/nats-server/v2 vulnerabilities disclosed?

14 vulnerabilities were recorded for github.com/nats-io/nats-server/v2 in the last 12 months, and the oldest entry in this database dates to 18 May 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/nats-io/nats-server/v2 are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/nats-io/nats-server/v2 for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/nats-io/nats-server/v2 version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.