CVE-2021-3127: Linuxfoundation Nats-Server

High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days.

NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled.

Affected products

• Linuxfoundation Nats-Server: from 2.0.0, before 2.2.0 (fixed in 2.2.0)
• Nats Jwt Library: before 2.0.1 (fixed in 2.0.1)

Published 2021-03-16. Last modified 2026-06-17.