Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐹
🐹 Go
Not in CISA KEV
CRITICAL severity

Incorrect handling of credential expiry by /nats-io/nats-serverGHSA-4w5x-x539-ppf5

CRITICALFix: nats-io/jwt@e11ce31

GHSA-4w5x-x539-ppf5 is a critical-severity (CVSS 9.8) Hard-coded Credentials vulnerability in github.com/nats-io/jwt. A fix is available for github.com/nats-io/jwt — see the affected versions and patch details below.

Also known asCVE-2020-26892GHSA-2c64-vj8g-vwrqGO-2022-0380
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Oct 12, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
2.3%probability of exploitation in next 30 days
Lower Risk+0.25%
Lower risk than most CVEs83th percentile — riskier than 83% of all scored CVEsHighest risk
0.02%0.97%1.91%2.86%0.6%2.3%Apr 26Aug 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

GHSA-4w5x-x539-ppf5 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 385,987 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

1 pkg affected
🐹github.com/nats-io/jwt

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Problem Description

NATS nats-server through 2020-10-07 has Incorrect Access Control because of how expired credentials are handled.

The NATS accounts system has expiration timestamps on credentials; the https://github.com/nats-io/jwt library had an API which encouraged misuse and an IsRevoked() method which misused its own API.

A new IsClaimRevoked() method has correct handling and the nats-server has been updated to use this. The old IsRevoked() method now always returns true and other client code will have to be updated to avoid calling it.

The CVE identifier should cover any application using the old JWT API, where the nats-server is one of those applications.

Affected versions

JWT library

  • all versions prior to 1.1.0
  • fixed after nats-io/jwt PR 103 landed (2020-10-06)

NATS Server

  • Version 2 prior to 2.1.9
    • 2.0.0 through and including 2.1.8 are vulnerable.
  • fixed with nats-io/nats-server PRs 1632, 1635, 1645

Impact

Time-based credential expiry did not work.

Workaround

Have credentials which only expire after fixes can be deployed.

Solution

Upgrade the JWT dependency in any application using it.

Upgrade the NATS server if using NATS Accounts.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐹Gogithub.com/nats-io/jwtall versions1.1.0go get github.com/nats-io/jwt@v1.1.0

Affected Products

2 products · 2 configurations
OS
fedorafedoraproject
1 version
33
Application
nats-serverlinuxfoundation
< 2.1.9
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/nats-io/jwt, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update github.com/nats-io/jwt to 1.1.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-4w5x-x539-ppf5 is resolved across your whole dependency graph.

  3. Workarounds

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

## Problem Description NATS nats-server through 2020-10-07 has Incorrect Access Control because of how expired credentials are handled. The NATS accounts system has expiration timestamps on credentials; the <https://github.com/nats-io/jwt> library had an API which encouraged misuse and an `IsRevoked()` method which misused its own API. A new `IsClaimRevoked()` method has correct handling and the nats-server has been updated to use this. The old `IsRevoked()` method now always returns true and other client code will have to be updated to avoid calling it. The CVE identifier should cover an
O3 Security · Impact-Aware SCA

Is GHSA-4w5x-x539-ppf5 in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works
Incorrect handling of credential expiry by /nats-io/nats-serv…