Sensitive data exposure in NATS

Description

Preview versions of two NPM packages and one Deno package from the NATS project contain an information disclosure flaw, leaking options to the NATS server; for one package, this includes TLS private credentials.

Recommendation

Update the nats.ws package to the latest compatible version. Followings are version details:

• Affected version(s): >= 1.0.0-85, <= 1.0.0-110
• Patched version(s): 1.0.0-111

References

• GHSA-82rf-q3pr-4f6p
• www.openwall.com
• CVE-2020-26149
• CWE-522
• CAPEC-310
• OWASP 2021-A4
• OWASP 2021-A6

Related Issues

• Command Injection Vulnerability - CVE-2021-21315
• Cloudera HUE Account Enumeration - CVE-2016-4947
• Cross-Site Scripting in exceljs - CVE-2018-16459
• Cross-Site Scripting in i18next - CVE-2017-16008

Tags:

npm

nats.ws