Read the docs
TI-2020-17280 Aliases CVE-2020-28466GHSA-m4jx-6526-vvhm

Denial of service (DoS) in github.com/nats-io/nats-server/server

Priority LOW 39CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightened risk. Any remote execution flaw or equivalent seriousness, or denial-of-service by unauthenticated users, will lead to prompt releases by the NATS maintainers. Fixes for denial of service issues with no threat of remote execution, when limited to account holders, are likely to just be committed to the main development branch with no special attention. Those who are running such services are encouraged to build regularly from git.

Why it matters now

EPSS 0.03729 89th percentileScored 2026-11-07
Fix Fixed github.com/nats-io/nats-server (Go): 2.2.0github.com/nats-io/nats-server/v2 (Go): 2.2.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—github.com/nats-io/nats-server/serverall versions—No fix listedCNA
—github.com/nats-io/nats-server (Go)before 2.2.02.2.0Patch availableGHSA-m4jx-6526-vvhm
—github.com/nats-io/nats-server/v2 (Go)before 2.2.02.2.0Patch availableGHSA-m4jx-6526-vvhm
  • github.com/nats-io/nats-server/server Vendor— Affected all versions Fixed in — No fix listed CNA
  • github.com/nats-io/nats-server (Go) Vendor— Affected before 2.2.0 Fixed in 2.2.0 Patch available GHSA-m4jx-6526-vvhm
  • github.com/nats-io/nats-server/v2 (Go) Vendor— Affected before 2.2.0 Fixed in 2.2.0 Patch available GHSA-m4jx-6526-vvhm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*2.0.0 to before 2.2.0Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.2.0 Vulnerable ·backstage

Remediation

  • Fix · GHSA-m4jx-6526-vvhm github.com/nats-io/nats-server (Go) Fixed in 2.2.0 Advisory →
  • Fix · GHSA-m4jx-6526-vvhm github.com/nats-io/nats-server/v2 (Go) Fixed in 2.2.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-28466
  2. 2026-10-03 Alias added: GHSA-m4jx-6526-vvhm

References

Patch 1

Advisory 2

Other 3

  • TI-2026-22233 NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead CVSS 3.1HIGH 7.5
  • TI-2022-11116 NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended… CVSS 3.1CRITICAL 9.8
  • TI-2020-16319 The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of… CVSS 3.1CRITICAL 9.8
  • TI-2026-25637 NATS has MQTT plaintext password disclosure CVSS 3.1HIGH 8.6
  • TI-2022-08320 NATS nats-server before 2.7.2 has Incorrect Access Control. CVSS 3.1HIGH 8.8
  • TI-2026-41950 NATS Server: Pre-auth server crash via double INFO in leafnode handshake CVSS 3.1HIGH 7.5
See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences