What’s Vulnerable › Vulnerabilities

CVE-2020-26149

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-09-30 · updated 2026-06-17
• Weakness: CWE-522

Description

NATS nats.js before 2.0.0-209, nats.ws before 1.0.0-111, and nats.deno before 1.0.0-9 allow credential disclosure from a client to a server.

Affected products

• Linuxfoundation Nats.Deno: before 1.0.0-9 — fixed in 1.0.0-9
• Linuxfoundation Nats.Js: before 2.0.0-209 — fixed in 2.0.0-209
• Linuxfoundation Nats.Ws: before 1.0.0-111 — fixed in 1.0.0-111

How to fix

Upgrade to a fixed version: Linuxfoundation Nats.Deno 1.0.0-9; Linuxfoundation Nats.Js 2.0.0-209; Linuxfoundation Nats.Ws 1.0.0-111. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2020/09/30/3
• https://github.com/nats-io/nats.deno/compare/v1.0.0-8...v1.0.0-9
• https://github.com/nats-io/nats.ws/commit/0a37ac2a411ff63f0707cda69a268c5fc4079eb7
• http://www.openwall.com/lists/oss-security/2020/09/30/3
• https://github.com/nats-io/nats.deno/compare/v1.0.0-8...v1.0.0-9
• https://github.com/nats-io/nats.ws/commit/0a37ac2a411ff63f0707cda69a268c5fc4079eb7

Get alerted when CVE-2020-26149 or the next vulnerability affects your stack