# NATS — CWE-407 Disclosure Brief
**2026-03-27 · Patch available — awaiting upstream merge**

## Finding

One O(n²) defect in NATS JetStream's cluster peer deduplication. `jetstream_cluster.go` uses `slices.Contains` inside an O(N²) peer-set rebuild loop during JetStream cluster operations. Patch ready for upstream review.

## The Defects

**nats-0001 (PATCHED — HIGH):** `server/jetstream_cluster.go`

```go
// JetStream peer dedup — O(N²) peer-set rebuild:
for _, peer := range peers {
    if slices.Contains(existingPeers, peer) {  // O(N) scan per peer
        continue
    }
    existingPeers = append(existingPeers, peer)
}
// O(N²) total peer-set construction
```

`slices.Contains(existingPeers, peer)` performs O(N) scan per peer during peer-set rebuild. **O(N²) total**. **Measured ratio: 50×.**

## Complexity Proof

For N=50 JetStream peers:
- O(N²) = 2,500 comparisons per rebuild
- Fixed: `map[string]struct{}` peer set → O(N)
- **50× measured ratio.**

## Impact

All NATS JetStream deployments using clustering. JetStream is NATS's persistence layer; peer-set rebuilds occur on cluster membership changes, leader elections, and stream placement decisions. NATS is a widely deployed cloud-native messaging system used in Kubernetes environments. Clusters with many JetStream peers and frequent topology changes hit worst case during peer reconciliation.

## The Fix

Replace `slices.Contains` with `map[string]struct{}`:

```go
// Before
if slices.Contains(existingPeers, peer) { continue }  // O(N)

// After
// CWE-407 fix: map[string]struct{} for O(1) peer dedup instead of O(N) slices.Contains.
peerSet := make(map[string]struct{}, len(existingPeers))
for _, p := range existingPeers { peerSet[p] = struct{}{} }
if _, ok := peerSet[peer]; ok { continue }
```

## Patch

`defects/nats/patch/nats-0001-jetstream-cluster-peer-map.patch`

## What We Ask

1. Confirm receipt and assign a GitHub Security Advisory or issue reference.
2. Validate the patch against your JetStream cluster test suite.
3. Assess CVE eligibility — fires on every cluster peer-set rebuild event.
4. Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.
