CVE-2020-26521
Nil dereference in NATS JWT, DoS of nats-server
The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code).
- Record
CVE-2020-26521- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-476
- Updated
- 2026-11-02
CVE List No score
The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code).
- Record
CVE-2020-26521- Updated
- 2026-11-02
EUVDEUVD-2022-1028 No score
The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code).
- Record
EUVD-2022-1028- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h2fg-54x9-5qhq
Nil dereference in NATS JWT, DoS of nats-server
Problem Description
The NATS account system has an Operator trusted by the servers, which signs Accounts, and each Account can then create and sign Users within their account. The Operator should be able to safely issue Accounts to other entities which it does not fully trust.
A malicious Account could create and sign a User JWT with a state not created by the normal tooling, such that decoding by the NATS JWT library (written in Go) would attempt a nil dereference, aborting execution.
The NATS Server is known to be impacted by this.
Affected versions
JWT library
- all versions prior to 1.1.0
NATS Server
- Version 2 prior to 2.1.9
Impact
JWT library
- Programs would nil dereference and panic, aborting execution by default.
NATS server
- Denial of Service caused by process termination
Workaround
If your NATS servers do not trust any accounts which are managed by untrusted entities, then malformed User credentials are unlikely to be encountered.
Solution
Upgrade the JWT dependency in any application using it.
Upgrade the NATS server if using NATS Accounts.
- Record
GHSA-h2fg-54x9-5qhq- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hmm9-r2m2-qg9w
Nil dereference in NATS JWT causing DoS of nats-server
(This advisory is canonically https://advisories.nats.io/CVE/CVE-2020-26521.txt)
Problem Description
The NATS account system has an Operator trusted by the servers, which signs Accounts, and each Account can then create and sign Users within their account. The Operator should be able to safely issue Accounts to other entities which it does not fully trust.
A malicious Account could create and sign a User JWT with a state not created by the normal tooling, such that decoding by the NATS JWT library (written in Go) would attempt a nil dereference, aborting execution.
The NATS Server is known to be impacted by this.
Affected versions
JWT library
- all versions prior to 1.1.0
NATS Server
- Version 2 prior to 2.1.9
Impact
JWT library
- Programs would nil dereference and panic, aborting execution by default.
NATS server
- Denial of Service caused by process termination
Workaround
If your NATS servers do not trust any accounts which are managed by untrusted entities, then malformed User credentials are unlikely to be encountered.
Solution
Upgrade the JWT dependency in any application using it.
Upgrade the NATS server if using NATS Accounts.
- Record
GHSA-hmm9-r2m2-qg9w- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSV
The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code).
- Record
CVE-2020-26521- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2020-26521
The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code).
- Record
DEBIAN-CVE-2020-26521- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-h2fg-54x9-5qhq
Nil dereference in NATS JWT, DoS of nats-server
Problem Description
The NATS account system has an Operator trusted by the servers, which signs Accounts, and each Account can then create and sign Users within their account. The Operator should be able to safely issue Accounts to other entities which it does not fully trust.
A malicious Account could create and sign a User JWT with a state not created by the normal tooling, such that decoding by the NATS JWT library (written in Go) would attempt a nil dereference, aborting execution.
The NATS Server is known to be impacted by this.
Affected versions
JWT library
- all versions prior to 1.1.0
NATS Server
- Version 2 prior to 2.1.9
Impact
JWT library
- Programs would nil dereference and panic, aborting execution by default.
NATS server
- Denial of Service caused by process termination
Workaround
If your NATS servers do not trust any accounts which are managed by untrusted entities, then malformed User credentials are unlikely to be encountered.
Solution
Upgrade the JWT dependency in any application using it.
Upgrade the NATS server if using NATS Accounts.
- Record
GHSA-h2fg-54x9-5qhq- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSVGHSA-hmm9-r2m2-qg9w
Nil dereference in NATS JWT causing DoS of nats-server
(This advisory is canonically https://advisories.nats.io/CVE/CVE-2020-26521.txt)
Problem Description
The NATS account system has an Operator trusted by the servers, which signs Accounts, and each Account can then create and sign Users within their account. The Operator should be able to safely issue Accounts to other entities which it does not fully trust.
A malicious Account could create and sign a User JWT with a state not created by the normal tooling, such that decoding by the NATS JWT library (written in Go) would attempt a nil dereference, aborting execution.
The NATS Server is known to be impacted by this.
Affected versions
JWT library
- all versions prior to 1.1.0
NATS Server
- Version 2 prior to 2.1.9
Impact
JWT library
- Programs would nil dereference and panic, aborting execution by default.
NATS server
- Denial of Service caused by process termination
Workaround
If your NATS servers do not trust any accounts which are managed by untrusted entities, then malformed User credentials are unlikely to be encountered.
Solution
Upgrade the JWT dependency in any application using it.
Upgrade the NATS server if using NATS Accounts.
- Record
GHSA-hmm9-r2m2-qg9w- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-26521
The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code).
- Record
UBUNTU-CVE-2020-26521- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGO-2022-0402 No score
Panic in NATS JWT decoding in github.com/nats-io/jwt
A malicious account can create and sign a User JWT which causes a panic when decoded by the NATS JWT library.
- Record
GO-2022-0402- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/nats-io/jwtGo |
before 1.1.0 | 1.1.0 |
github.com/nats-io/nats-server/v2Go |
before 2.1.9 | 2.1.9 |
golang-github-nats-io-jwtDebian:12 |
before 2.2.0-1 | 2.2.0-1 |
golang-github-nats-io-jwtDebian:13 |
before 2.2.0-1 | 2.2.0-1 |
golang-github-nats-io-jwtDebian:14 |
before 2.2.0-1 | 2.2.0-1 |
golang-github-nats-io-jwtUbuntu:20.04:LTS |
All versions, plus listed versions 0.0~git20181120.285cf2c-4 |
None known |
golang-github-nats-io-jwtUbuntu:22.04:LTS |
All versions, plus listed versions 0.0~git20181120.285cf2c-4.1 |
None known |
golang-github-nats-io-jwtUbuntu:24.04:LTS |
All versions, plus listed versions 2.4.1-12.5.2-12.5.2-2 |
None known |
golang-github-nats-io-jwtUbuntu:25.10 |
All versions, plus listed versions 2.7.3-1 |
None known |
golang-github-nats-io-jwtUbuntu:26.10 |
All versions, plus listed versions 2.8.0-12.8.1-12.8.2-1 |
None known |
golang-github-nats-io-jwtUbuntu:26.04:LTS |
All versions, plus listed versions 2.7.3-12.8.0-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-26521 is a high vulnerability (CVSS 7.5) in Linuxfoundation Nats-server, published November 6, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.16%, the 82nd percentile. Fixed in github.com/nats-io/jwt 1.1.0.
References
github.com/nats-io/nats-server/commits/master
openwall.com/lists/oss-security/2020/11/02/2
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT67XCLIIBYRT762SVFBYFFTQFVSM3SI
nvd.nist.gov/vuln/detail/CVE-2020-26521
Show 12 moreShow less
advisories.nats.io/CVE/CVE-2020-26521.txt
pkg.go.dev/vuln/GO-2022-0402
security-tracker.debian.org/tracker/CVE-2020-26521
ubuntu.com/security/CVE-2020-26521
cve.org/CVERecord?id=CVE-2020-26521