github.com/nats-io/nats-server v1.4.1

Why

• warnVulnerability

  Incorrect Authorization in NATS nats-server in github.com/nats-io/nats-server

• warnVulnerability

  Arbitrary file write in nats-server in github.com/nats-io/nats-server

• warnVulnerability

  Import loops in account imports, nats-server DoS in github.com/nats-io/nats-server

• warnVulnerability

  Integer Overflow or Wraparound in NATS Server in github.com/nats-io/nats-server

• warnVulnerability

  Denial of service in github.com/nats-io/nats-server/server in github.com/nats-io/nats-server

• warnVulnerability

  NATS nats-server allows directory traversal via unintended path to a management action in github.com/nats-io/nats-server

• warnVulnerability

  NATS server TLS missing ciphersuite settings when CLI flags used in github.com/nats-io/nats-server

• warnVulnerability

  NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects in github.com/nats-io/nats-server

• warnVulnerability

  nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server

• warnVulnerability

  NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server

• warnVulnerability

  NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server

• warnVulnerability

  NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server

• warnVulnerability

  NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server

• warnVulnerability

  NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server

• warnVulnerability

  NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server

• warnVulnerability

  NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server

• warnVulnerability

  NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server

• warnVulnerability

  NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server

• warnVulnerability

  NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server

• warnVulnerability

  NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server

• warnVulnerability

  NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server

• warnVulnerability

  NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server

• warnVulnerability

  NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching

• warnVulnerability

  NATS Server panic via malicious compression on leafnode port

• warnVulnerability

  NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers

• warnVulnerability

  NATS is vulnerable to pre-auth DoS through WebSockets client service

• warnVulnerability

  NATS JetStream has an authorization bypass through its Management API

• warnVulnerability

  NATS allows MQTT clients to bypass ACL checks

• warnVulnerability

  Denial of service in github.com/nats-io/nats-server/server (fixed in 2.2.0)

• warnVulnerability

  NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead

• warnVulnerability

  NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing

• warnVulnerability

  nats-server websockets are vulnerable to pre-auth memory DoS

• warnVulnerability

  NATS has MQTT plaintext password disclosure

• warnVulnerability

  NATS has pre-auth server panic via leafnode handling

What the code does

On its own this is weak signal: plenty of honest libraries read files or talk to the network. What PkgFire watches is a release gaining something the one before it did not.