Sensitive data exposure in NATS

Preview versions of two NPM packages and one Deno package from the NATS project contain an information disclosure flaw, leaking options to the NATS server; for one package, this includes TLS private credentials. The connection configuration options in these JavaScript-based implementations were...

CVE-2020-26149

NATS nats.js before 2.0.0-209, nats.ws before 1.0.0-111, and nats.deno before 1.0.0-9 allow credential disclosure from a client to a server...

Design/Logic Flaw

NATS nats.js before 2.0.0-209, nats.ws before 1.0.0-111, and nats.deno before 1.0.0-9 allow credential disclosure from a client to a server...

CVE-2020-26149

CVE-2020-26149 affects NATS client libraries in JavaScript/TypeScript ecosystems: nats.js, nats.ws, and nats.deno. The root cause is a information/credential disclosure flaw where sensitive credentials (including TLS client private keys in mutual TLS setups) can be leaked from the client to the s...