CRITICAL9.8Go
GHSA-4w5x-x539-ppf5· CVE-2020-26892, GHSA-2c64-vj8g-vwrqIncorrect handling of credential expiry by /nats-io/nats-server
Modified: 9/10/2026
package
Go/github.com/nats-io/jwt
pkg:go/github.com/nats-io/jwt
CRITICALGo
GHSA-62mh-w5cv-p88c· BIT-nats-2021-3127, CVE-2021-3127nats-io/jwt not enforcing checking of Import token permissions
Modified: 9/10/2026
HIGH7.5Go
GHSA-h2fg-54x9-5qhq· CVE-2020-26521, GHSA-hmm9-r2m2-qg9wNil dereference in NATS JWT, DoS of nats-server
Modified: 9/10/2026
—Go
GO-2022-0380· CVE-2020-26892, GHSA-2c64-vj8g-vwrqIncorrect handling of credential expiry in github.com/nats-io/jwt
Modified: 2/4/2026
—Go
GO-2022-0386· BIT-nats-2021-3127, CVE-2021-3127Import token permissions checking not enforced in github.com/nats-io/jwt
Modified: 2/4/2026
—Go
GO-2022-0402· CVE-2020-26521, GHSA-h2fg-54x9-5qhqPanic in NATS JWT decoding in github.com/nats-io/jwt
Modified: 2/4/2026