GHSA-8m2x-3m6q-6w8j

Source

https://github.com/advisories/GHSA-8m2x-3m6q-6w8j

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-8m2x-3m6q-6w8j/GHSA-8m2x-3m6q-6w8j.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-8m2x-3m6q-6w8j

Aliases

Downstream

CGA (58)

MINI (7)

Published

2026-03-24T20:37:08Z

Modified

2026-07-17T21:12:10Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

NATS: Message tracing can be redirected to arbitrary subject

Details

Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The nats-server supports telemetry on messages, using the per-message NATS headers.

Problem Description

A valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission.

The payload is a valid trace message and not chosen by the attacker.

Affected Versions

Any version before v2.12.6 or v2.11.15

Workarounds

None.

Database specific

{
    "cwe_ids":  [
        "CWE-863"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-24T20:37:08Z",
    "nvd_published_at":  "2026-03-25T21:16:47Z",
    "severity":  "MODERATE"
}

References

Affected packages

Go / github.com/nats-io/nats-server/v2

Package

Name: github.com/nats-io/nats-server/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/nats-io/nats-server/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.11.0

Fixed

2.11.15

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-8m2x-3m6q-6w8j/GHSA-8m2x-3m6q-6w8j.json"

Go / github.com/nats-io/nats-server/v2

Package

Name: github.com/nats-io/nats-server/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/nats-io/nats-server/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.12.0-preview.1

Fixed

2.12.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-8m2x-3m6q-6w8j/GHSA-8m2x-3m6q-6w8j.json"