| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/nats-io/nats-server | all versions | |
| github.com/nats-io/nats-server/v2 | ≥ 2.12.0-RC.1, < 2.12.6< 2.11.15 | 2.12.62.11.15 |
| nats-server | ≥ 2.12.0, < 2.12.6< 2.11.15 | 2.12.62.11.15 |
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.
The persistent storage feature, JetStream, has a management API which has many features, amongst which are backup and restore.
Users with JetStream admin API access to restore one stream could restore to other stream names, impacting data which should have been protected against them.
Any version before v2.12.6 or v2.11.15
If developers have configured users to have limited JetStream restore permissions, temporarily remove those permissions.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free