CVE-2020-26149 Sensitive data exposure in NATS
NATS client libraries allow credential disclosure from a client to a server, potentially exposing sensitive authentication data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-26149?
CVE-2020-26149 is a high-severity vulnerability in n/a, published on 30 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NATS nats.js before 2.0.0-209, nats.ws before 1.0.0-111, and nats.deno before 1.0.0-9 allow credential disclosure from a client to a server.
Weakness: CWE-522
Which versions are affected by CVE-2020-26149?
4 open source packages ship an affected version, including nats and nats.ws. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
nats npm | From 2.0.0-201 | 2.0.0-209 |
nats npm | From 2.0.0-201 | 2.0.0-209 |
nats.ws npm | From 1.0.0-85 | 1.0.0-111 |
nats.ws npm | From 1.0.0-85 | 1.0.0-111 |
Products include Linuxfoundation Nats.deno, Linuxfoundation Nats.js, Linuxfoundation Nats.ws.
How do I fix CVE-2020-26149?
Upgrade nats to 2.0.0-209 or later.
Is CVE-2020-26149 being exploited?
There is no known exploitation of CVE-2020-26149 in the wild and no public exploit code.
Sources
Also known as GHSA-82rf-q3pr-4f6p.