The NATS official Rust clients are vulnerable to MitM when using TLS. The common name of the server's TLS certificate is validated against the "host"name provided by the server's plaintext "INFO" message during the initial connection setup phase. A MitM proxy can tamper with the "host" field's value by substituting it with the common name of a valid certificate it controls, fooling the client into accepting it.