NATS — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in NATS JetStream's cluster peer deduplication. jetstream_cluster.go uses slices.Contains inside an O(N²) peer-set rebuild loop during JetStream cluster operations. Patch ready for upstream review.

The Defects

nats-0001 (PATCHED — HIGH): server/jetstream_cluster.go

// JetStream peer dedup — O(N²) peer-set rebuild:
for _, peer := range peers {
    if slices.Contains(existingPeers, peer) {  // O(N) scan per peer
        continue
    }
    existingPeers = append(existingPeers, peer)
}
// O(N²) total peer-set construction

slices.Contains(existingPeers, peer) performs O(N) scan per peer during peer-set rebuild. O(N²) total. Measured ratio: 50×.

Complexity Proof

For N=50 JetStream peers:

O(N²) = 2,500 comparisons per rebuild
Fixed: map[string]struct{} peer set → O(N)
50× measured ratio.

Impact

All NATS JetStream deployments using clustering. JetStream is NATS's persistence layer; peer-set rebuilds occur on cluster membership changes, leader elections, and stream placement decisions. NATS is a widely deployed cloud-native messaging system used in Kubernetes environments. Clusters with many JetStream peers and frequent topology changes hit worst case during peer reconciliation.

The Fix

Replace slices.Contains with map[string]struct{}:

// Before
if slices.Contains(existingPeers, peer) { continue }  // O(N)

// After
// CWE-407 fix: map[string]struct{} for O(1) peer dedup instead of O(N) slices.Contains.
peerSet := make(map[string]struct{}, len(existingPeers))
for _, p := range existingPeers { peerSet[p] = struct{}{} }
if _, ok := peerSet[peer]; ok { continue }

Patch

defects/nats/patch/nats-0001-jetstream-cluster-peer-map.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or issue reference.
Validate the patch against your JetStream cluster test suite.
Assess CVE eligibility — fires on every cluster peer-set rebuild event.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.2 KiB Raw Blame History Unescape Escape