From 0ea905cf21584baf5b644d13d1e01b77e81cf3f8 Mon Sep 17 00:00:00 2001
From: potato-20 <myank2082@gmail.com>
Date: Thu, 4 Jun 2026 18:36:29 +0530
Subject: [PATCH] Add NATS server version detection (TCP NULL probe)

Adds a service-detection match for the NATS messaging server, which sends
an 'INFO {...}' JSON banner containing its version immediately on connect
(default port 4222).

Before this, nmap -sV mis-identified NATS as 'MongoDB 14.2' via the loose
catch-all mongodb match (^.*version.....); the new NULL-probe match fires
first and reports it correctly, e.g.:

  4222/tcp open  nats  NATS server 2.14.2

Validated with nmap against nats:latest/2.10/2.9 in Docker (true positive,
correct version + CPE), with no false match against redis or nginx. CPE
uses the NVD vendor/product cpe:/a:linuxfoundation:nats-server.
---
 nmap-service-probes | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/nmap-service-probes b/nmap-service-probes
index 0d6b41e29..a993ac660 100644
--- a/nmap-service-probes
+++ b/nmap-service-probes
@@ -2105,6 +2105,9 @@ match mwti-rpc m=^Welcome MWTI RPC Communication Server Version ([\w._-]+) \[(?:
 
 softmatch napster m|^1$|
 
+# NATS messaging system; the server sends an INFO {...} JSON banner including its version on connect (default port 4222)
+match nats m|^INFO \{"server_id":"\w+".*?"version":"([\d][\w.+-]*)"|s p/NATS server/ v/$1/ cpe:/a:linuxfoundation:nats-server:$1/
+
 # Ncat --chat mode, since 4.85BETA4
 match ncat-chat m|^<announce> [\d.:a-f]+ is connected as <\w+>\.\n<announce> already connected: (.*?)\.\n| p/Ncat chat/ i/users: $1/