Description
NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | nats-server | No fix yet | — |
| Ubuntu 25.10 | nats-server | No fix yet | — |
| Ubuntu 24.04 LTS | nats-server | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | nats-server | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/nats-io/nats-server | >= 2.2.0, < 2.7.4 | 2.7.4 | GHSA-vpjc-4jcv-jc29 |
| Go | github.com/nats-io/nats-server | all versions | — | GO-2023-2066 |
| Go | github.com/nats-io/nats-server/v2 | >= 2.2.0, < 2.7.4 | 2.7.4 | GO-2023-2066 |