github.com/nats-io/nats-server vulnerabilities (Go)

22 vulnerabilities.

• github.com/nats-io/nats-server Go NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead CVE-2026-27889 Fix available 7.5 HighMarch 25, 2026
• github.com/nats-io/nats-server Go NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching CVE-2026-33248 Fix available 4.2 MediumMarch 24, 2026
• github.com/nats-io/nats-server Go NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers CVE-2026-33246 Fix available 6.4 MediumMarch 24, 2026
• github.com/nats-io/nats-server Go NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing CVE-2026-33223 Fix available 6.4 MediumMarch 24, 2026
• github.com/nats-io/nats-server Go NATS JetStream has an authorization bypass through its Management API CVE-2026-33222 Fix available 4.9 MediumMarch 24, 2026
• github.com/nats-io/nats-server Go NATS is vulnerable to pre-auth DoS through WebSockets client service CVE-2026-33219 Fix available 5.3 MediumMarch 24, 2026
• github.com/nats-io/nats-server Go NATS has pre-auth server panic via leafnode handling CVE-2026-33218 Fix available 7.5 HighMarch 24, 2026
• github.com/nats-io/nats-server Go NATS allows MQTT clients to bypass ACL checks CVE-2026-33217 Fix available 7.1 HighMarch 24, 2026
• github.com/nats-io/nats-server Go NATS has MQTT plaintext password disclosure CVE-2026-33216 Fix available 8.6 HighMarch 24, 2026
• github.com/nats-io/nats-server Go NATS Server panic via malicious compression on leafnode port CVE-2026-29785 Fix available 7.5 HighMarch 24, 2026
• github.com/nats-io/nats-server Go NATS is vulnerable to MQTT hijacking via Client ID CVE-2026-33215 Fix available 6.5 MediumMarch 24, 2026
• github.com/nats-io/nats-server Go NATS credentials are exposed in monitoring port via command-line argv CVE-2026-33247 Fix available 7.4 HighMarch 24, 2026
• github.com/nats-io/nats-server Go NATS: Message tracing can be redirected to arbitrary subject CVE-2026-33249 Fix available 4.3 MediumMarch 24, 2026
• github.com/nats-io/nats-server Go nats-server websockets are vulnerable to pre-auth memory DoS CVE-2026-27571 Fix available 5.9 MediumFebruary 24, 2026
• github.com/nats-io/nats-server Go NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects CVE-2022-29946 Fix available 6.3 MediumJuly 11, 2024
• github.com/nats-io/nats-server Go NATS server TLS missing ciphersuite settings when CLI flags used CVE-2021-32026 Fix available No scoreMay 14, 2024
• github.com/nats-io/nats-server Go NATS nats-server allows directory traversal via unintended path to a management action CVE-2022-28357 Fix available 9.8 CriticalSeptember 19, 2023
• github.com/nats-io/nats-server Go Arbitrary file write in nats-server CVE-2022-26652 Fix available 6.5 MediumMarch 10, 2022
• github.com/nats-io/nats-server Go Incorrect Authorization in NATS nats-server CVE-2022-24450 Fix available 8.8 HighFebruary 8, 2022
• github.com/nats-io/nats-server Go Import loops in account imports, nats-server DoS GHSA-gwj5-3vfq-q992 Fix available 7.5 HighMay 21, 2021
• github.com/nats-io/nats-server Go Denial of Service (DoS) CVE-2020-28466 Fix available 7.5 HighMarch 7, 2021
• github.com/nats-io/nats-server Go Integer Overflow or Wraparound in NATS Server CVE-2019-13126 Fix available 7.5 HighJuly 29, 2019