GHSA-hmm9-r2m2-qg9w: 
vulnerability analysis and mitigation

The vulnerability (CVE-2020-26521) affects the NATS JWT library and NATS server versions prior to 2.1.9, discovered and disclosed on November 2, 2020. The issue involves a nil dereference vulnerability in the NATS JWT library that could lead to server termination. The vulnerability affects all versions of the JWT library prior to 1.1.0 and NATS Server Version 2 prior to 2.1.9 (NATS Advisory, GitHub Advisory).

The vulnerability stems from the NATS account system's handling of User JWTs. A malicious Account could create and sign a User JWT with a state not created by normal tooling, leading to a nil dereference attempt during decoding by the NATS JWT library. This vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating a network-accessible vulnerability requiring no privileges or user interaction (GitHub Advisory).

The primary impact of this vulnerability is a Denial of Service condition. For the JWT library, affected programs would experience a nil dereference and panic, leading to execution abortion by default. For the NATS server specifically, this results in process termination, effectively causing a denial of service (NATS Advisory).

The vulnerability can be exploited by a malicious Account holder who creates and signs a specially crafted User JWT. The exploitation requires no special privileges or user interaction, making it relatively straightforward to execute for an attacker with access to account creation capabilities (GitHub Advisory).

The primary mitigation is to upgrade the JWT dependency to version 1.1.0 or later, and upgrade the NATS server to version 2.1.9 or later if using NATS Accounts. As a workaround, if NATS servers do not trust any accounts managed by untrusted entities, then malformed User credentials are unlikely to be encountered (NATS Advisory).