nats

Activity

Latest release: 5mo ago
Total releases: 74
Cadence: ~11 days
Last 12 months: 1

Details

License: Apache-2.0
First release: Sep 08, 2015

Releases

Version	Released
`0.26.0` unknown	Mar 19, 2026
`0.25.0` unknown	Apr 22, 2024
`0.24.1` unknown	Nov 08, 2023
`0.24.0` unknown 1 CVE	Feb 13, 2023
`0.23.1` unknown 1 CVE	Nov 11, 2022
`0.23.0` unknown 1 CVE	Aug 07, 2022
`0.22.0` unknown 1 CVE	Jul 10, 2022
`0.21.0` unknown 1 CVE	Jun 17, 2022
`0.20.1` unknown 1 CVE	May 23, 2022
`0.20.0` unknown 1 CVE	May 09, 2022
`0.19.1` unknown 1 CVE	Apr 28, 2022
`0.19.0` unknown 1 CVE	Apr 17, 2022
`0.18.1` unknown 1 CVE	Feb 11, 2022
`0.18.0` unknown 1 CVE	Feb 08, 2022
`0.17.0` unknown 1 CVE	Jan 21, 2022
`0.16.0` unknown 1 CVE	Nov 01, 2021
`0.15.2` unknown 1 CVE	Sep 15, 2021
`0.15.1` unknown 1 CVE	Sep 01, 2021
`0.15.0` unknown 1 CVE	Sep 01, 2021
`0.14.0` unknown 1 CVE	Sep 01, 2021
`0.13.1` unknown 1 CVE	Sep 01, 2021
`0.13.0` unknown 1 CVE	Aug 11, 2021
`0.12.1` unknown 1 CVE	Aug 11, 2021
`0.12.0` unknown 1 CVE	Aug 11, 2021
`0.11.0` unknown 1 CVE	Aug 04, 2021
`0.10.1` unknown 1 CVE	Jul 21, 2021
`0.10.0` unknown 1 CVE	Jul 21, 2021
`0.9.19` unknown yanked 1 CVE	Jul 21, 2021
`0.9.18` unknown 1 CVE	May 31, 2021
`0.9.17` unknown 1 CVE	May 19, 2021
`0.9.16` unknown 1 CVE	Apr 29, 2021
`0.9.15` unknown 1 CVE	Apr 29, 2021
`0.9.14` unknown 1 CVE	Apr 22, 2021
`0.9.13` unknown 1 CVE	Apr 22, 2021
`0.9.12` unknown 1 CVE	Apr 12, 2021
`0.9.11` unknown 1 CVE	Apr 12, 2021
`0.9.10` unknown 1 CVE	Apr 12, 2021
`0.9.9` unknown 1 CVE	Apr 08, 2021
`0.9.8` unknown 1 CVE	Mar 22, 2021
`0.9.7` unknown 1 CVE	Mar 10, 2021
`0.9.6` unknown 1 CVE	Mar 09, 2021
`0.9.5` unknown 1 CVE	Mar 08, 2021
`0.9.4` unknown 1 CVE	Feb 09, 2021
`0.9.3` unknown 1 CVE	Feb 08, 2021
`0.9.2` unknown 1 CVE	Jan 26, 2021
`0.9.1` unknown 1 CVE	Jan 12, 2021
`0.9.0` unknown 1 CVE	Jan 11, 2021
`0.8.6` unknown	Nov 19, 2020
`0.8.5` unknown	Nov 17, 2020
`0.8.4` unknown	Nov 17, 2020

1–50 of 74

Dependencies (36)

Depends on

0.26.0

Used by

Supply-chain exposure

38 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Vulnerable dependencies

3 of 36

json 1 CVE
rustls-pemfile 1 CVE
structopt 1 CVE

These dependencies are still vulnerable in their latest release. Whether the exact version this package pins is affected isn't checked yet.

Known CVEs (1)

GHSA-wvc4-j7g5-4f79 RUSTSEC-2023-0029 Mar 27, 2023

NATS TLS certificate common name validation bypass

Medium

The NATS official Rust clients are vulnerable to MitM when using TLS.

A fix for the nats crate hasn't been released yet. Since the nats crate is going to be deprecated anyway, consider switching to async-nats >= 0.29 which already fixed this vulnerability.

The common name of the server's TLS certificate is validated against the hostname provided by the server's plaintext INFO message during the initial connection setup phase. A MitM proxy can tamper with the host field's value by substituting it with the common name of a valid certificate it controls, fooling the client into accepting it.

Reproduction steps

The NATS Rust client tries to establish a new connection

The connection is intercepted by a MitM proxy

The proxy makes a separate connection to the NATS server

The NATS server replies with an INFO message

The proxy reads the INFO, alters the host JSON field and passes the tampered INFO back to the client

The proxy upgrades the client connection to TLS, presenting a certificate issued by a certificate authority present in the client's keychain. In the previous step the host was set to the common name of said certificate

rustls accepts the certificate, having verified that the common name matches the attacker-controlled value it was given

The client has been fooled by the MitM proxy into accepting the attacker-controlled certificate

Fixed in

0.24.1

References

https://github.com/nats-io/nats.rs/pull/881
https://github.com/nats-io/nats.rs/pull/887
https://github.com/nats-io/nats.rs/commit/9bacb86a480803ece9d1a45aa443081cf1eb815c
https://github.com/nats-io/nats.rs
https://rustsec.org/advisories/RUSTSEC-2023-0029.html

Updated Nov 08, 2023 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

unknown 74

74 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More