Information Disclosure in nats npm Package

nats Updated 02 Oct 2025

Summary

06/04/2021

Disclosed on

CRITICAL

Severity

Yes i

Fix available

Critical

Severity

Not published

CVSS Score

GHSA-prmc-5v5w-c465: Client TLS credentials sent raw to server in npm package nats. Affects nats versions >= 2.0.0-201, < 2.0.0-209. Fixed in 2.0.0-209. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The nats package is a Node.js client for the NATS messaging system. It allows applications to connect to a NATS server and exchange messages. The package supports various authentication mechanisms, including Mutual TLS for secure communication. However, preview versions of the nats.js, nats.ws, and nats.deno packages contain an information disclosure flaw. This flaw leaks options to the NATS server, including TLS private credentials in the case of nats.js. The flaw occurs when the connection configuration options are serialized and sent to the server immediately after TLS establishment. This vulnerability affects specific versions of the nats.js, nats.ws, and nats.deno packages.

Vulnerability Detail

The vulnerability in the nats package allows for the disclosure of TLS client credentials, including the private key, to the server. This can lead to the leakage of sensitive information if the server is untrusted or if the client application disables TLS verification. The flaw occurs due to the serialization and transmission of the connection configuration options to the server. It is important to note that NATS account NKey authentication is not affected by this vulnerability. The affected versions of the nats package are listed below:

How To Fix

Minimum fixed version

2.0.0-209

This is the first release that contains the fix.

npm install nats@2.0.0-209

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

There is no known workaround for this vulnerability. Upgrading to the fixed versions is the recommended solution.

Conclusion

In conclusion, the nats package is vulnerable to an information disclosure flaw that can lead to the leakage of TLS client credentials. It is crucial to upgrade to the fixed versions and reissue TLS client credentials to mitigate the risk of sensitive information disclosure. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for nats →

FAQ

What is the impact of this vulnerability?

The impact of this vulnerability is the potential leakage of TLS client credentials, including the private key, to the server. If the server is untrusted or if TLS verification is disabled, this can lead to the disclosure of sensitive information and authentication credentials.