Sensitive data exposure in NATS

Description

Preview versions of two NPM packages and one Deno package from the NATS project contain an information disclosure flaw, leaking options to the NATS server; for one package, this includes TLS private credentials.

Recommendation

Update the nats.ws package to the latest compatible version. Followings are version details:

• Affected version(s): >= 1.0.0-85, <= 1.0.0-110
• Patched version(s): 1.0.0-111

References

• GHSA-82rf-q3pr-4f6p
• www.openwall.com
• CVE-2020-26149
• CWE-522
• CAPEC-310
• OWASP 2021-A4
• OWASP 2021-A6

Related Issues

• Sensitive data exposure in NATS (GHSA-82rf-q3pr-4f6p) - CVE-2020-26149
• Exposure of Sensitive Information to an Unauthorized Actor in AEgir - CVE-2020-11059
• Strapi core vulnerable to sensitive data exposure via CORS misconfiguration - CVE-2025-53092
• Sensitive Data Exposure in seneca - CVE-2019-5483

Tags:

npm

nats.ws