modules:
  - module: github.com/nats-io/jwt
    versions:
      - fixed: 1.1.0
    vulnerable_at: 1.0.1
    packages:
      - package: github.com/nats-io/jwt
        symbols:
          - Export.Validate
          - Import.Validate
          - Imports.Validate
        derived_symbols:
          - Account.Validate
          - AccountClaims.Validate
          - Exports.Validate
description: |
    A malicious account can create and sign a User JWT which causes a panic
    when decoded by the NATS JWT library.
published: 2022-07-01T20:10:43Z
cves:
  - CVE-2020-26521
ghsas:
  - GHSA-hmm9-r2m2-qg9w
  - GHSA-h2fg-54x9-5qhq
references:
  - fix: https://github.com/nats-io/jwt/pull/107
  - web: https://advisories.nats.io/CVE/CVE-2020-26521.txt