Background
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT and edge computing.
The NATS Server can accept client connections over WebSocket and can also support MQTT over WebSocket when MQTT is configured.
Problem Description
A WebSocket listener could route requests for the MQTT-over-WebSocket path into MQTT handling even when MQTT was not configured.
On affected deployments, an unauthenticated client with access to the WebSocket listener could reach uninitialized MQTT state and crash the server process.
This affects deployments that enable WebSocket while leaving MQTT disabled. Deployments where MQTT is intentionally configured initialize the MQTT state and are not affected in the same way.
Affected Versions
Versions v2.14.2, v2.12.11 and below are vulnerable. The issue is fixed in v2.14.3 and v2.12.12.
Workarounds
Deployments not using WebSocket are not affected. Deployments using both WebSockets and MQTT are not affected. No known workaround for deployments that need WebSocket without MQTT-over-WebSocket. Upgrade to a fixed release.
References
Background
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT and edge computing.
The NATS Server can accept client connections over WebSocket and can also support MQTT over WebSocket when MQTT is configured.
Problem Description
A WebSocket listener could route requests for the MQTT-over-WebSocket path into MQTT handling even when MQTT was not configured.
On affected deployments, an unauthenticated client with access to the WebSocket listener could reach uninitialized MQTT state and crash the server process.
This affects deployments that enable WebSocket while leaving MQTT disabled. Deployments where MQTT is intentionally configured initialize the MQTT state and are not affected in the same way.
Affected Versions
Versions v2.14.2, v2.12.11 and below are vulnerable. The issue is fixed in v2.14.3 and v2.12.12.
Workarounds
Deployments not using WebSocket are not affected. Deployments using both WebSockets and MQTT are not affected. No known workaround for deployments that need WebSocket without MQTT-over-WebSocket. Upgrade to a fixed release.
References