Go/github.com/nats-io/nats-server/v2 CVE-2022-26652: medium 6.5, EPSS 2.34%

Arbitrary file write in nats-server

Action: Upgrade github.com/nats-io/nats-server/v2 to 2.7.4 or later.

go get github.com/nats-io/nats-server/v2@v2.7.4

Affected

Fixed versions

Sources

• osv: GHSA-6h3m-36w8-hv68
• https://github.com/nats-io/nats-server/security/advisories/GHSA-6h3m-36w8-hv68
• https://nvd.nist.gov/vuln/detail/CVE-2022-26652
• https://github.com/nats-io/nats-server/pull/2917
• https://advisories.nats.io/CVE/CVE-2022-26652.txt
• https://github.com/nats-io/nats-server
• https://github.com/nats-io/nats-server/releases
• https://github.com/nats-io/nats-server/releases/tag/v2.7.4
• https://github.com/nats-io/nats-streaming-server/releases/tag/v0.24.3
• http://www.openwall.com/lists/oss-security/2022/03/10/1

CVE-2022-26652 · published 2022-03-10T22:07:30Z · modified 2026-07-08T06:29:51.186865744Z · JSON