Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

nats-io/nats-server

              main @ 09c721a
            

154

Fixes

CVEs

CRITICAL

Peak severity

38.5%

Coverage

Highlights

Auth Bypass: 112 prior fixes. Scrutinize any change in this area.

server/client.go: most-fixed (28 issues). Treat as high-risk during review.

79 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Leafnode connections historically failed to validate or propagate subject-level publication and subscription permissions. This allowed unauthorized message flow, incorrect merging of local deny clauses, and unauthorized permission modifications on unsolicited leafnode connections.

Auth Bypass: Subject subscription validation logic allowed clients to bypass ACL restrictions through overlapping wildcard subjects, queue group join bypasses, or by overwriting previous deny decisions during queue-based permission evaluations.

Protocol Injection: Failure to validate MQTT topics and publish payloads allowed attackers to inject control characters (CRLF/carriage returns) directly into the NATS wire protocol stream, leading to command injection and protocol corruption.