CWE-757: Default TLS minimum version set to TLS 1.0 (deprecated, vulnerable to downgrade)

Summary

The default TLS configuration in nsqd sets the minimum protocol version to TLS 1.0, which has been formally deprecated since RFC 8996 (March 2021).

Details

nsqd/options.go:182:

TLSMinVersion: tls.VersionTLS10,

Users who don't explicitly set --tls-min-version=tlsv1.2 get TLS 1.0.

Impact

• TLS 1.0 has known vulnerabilities: BEAST (CVE-2011-3389), POODLE (CVE-2014-3566)
• Violates PCI DSS 3.1+ and FedRAMP compliance requirements

Remediation

Change to TLSMinVersion: tls.VersionTLS12, as default.