Nats-io vulnerabilities

Products

• Nats-server 27

Newest

• linuxfoundation nats-server NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled CVE-2026-58208 Fix available 6.8 MediumJuly 8, 2026
• linuxfoundation nats-server NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions CVE-2026-58211 Fix available 5.4 MediumJuly 8, 2026
• linuxfoundation nats-server NATS Server: Remote crash via integer overflow in Connz pagination CVE-2026-58207 Fix available 7.7 HighJuly 8, 2026
• linuxfoundation nats-server NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory CVE-2026-58210 Fix available 7.5 HighJuly 8, 2026
• linuxfoundation nats-server NATS Server: MQTT retained and QoS replay bypass subscribe deny filters CVE-2026-58209 Fix available 4.3 MediumJuly 8, 2026
• linuxfoundation nats-server NATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217) CVE-2026-58214 Fix available 4.3 MediumJuly 8, 2026
• linuxfoundation nats-server NATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission check CVE-2026-58254 Fix available 5.3 MediumJuly 8, 2026
• linuxfoundation nats-server NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection CVE-2026-58213 Fix available 7.1 HighJuly 8, 2026
• linuxfoundation nats-server NATS Server: Pre-auth server crash via double INFO in leafnode handshake CVE-2026-58250 Fix available 7.5 HighJuly 8, 2026
• linuxfoundation nats-server NATS Server: Subscribe Authz Bypass via Wildcard-Overlap CVE-2026-58252 Fix available 6.5 MediumJuly 8, 2026
• linuxfoundation nats-server NATS Server: Route API Auth Bypass CVE-2026-58253 Fix available 8.8 HighJuly 8, 2026
• linuxfoundation nats-server NATS Server: Queue Subscribe Authz Bypass CVE-2026-58251 Fix available 6.5 MediumJuly 8, 2026
• linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 more NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead CVE-2026-27889 Fix available 7.5 HighMarch 25, 2026
• linuxfoundation nats-server NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching CVE-2026-33248 Fix available 4.2 MediumMarch 24, 2026
• linuxfoundation nats-server NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers CVE-2026-33246 Fix available 6.4 MediumMarch 24, 2026
• linuxfoundation nats-server NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing CVE-2026-33223 Fix available 6.4 MediumMarch 24, 2026
• linuxfoundation nats-server NATS JetStream has an authorization bypass through its Management API CVE-2026-33222 Fix available 4.9 MediumMarch 24, 2026
• linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 more NATS is vulnerable to pre-auth DoS through WebSockets client service CVE-2026-33219 Fix available 5.3 MediumMarch 24, 2026
• linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 more NATS has pre-auth server panic via leafnode handling CVE-2026-33218 Fix available 7.5 HighMarch 24, 2026
• linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 more NATS allows MQTT clients to bypass ACL checks CVE-2026-33217 Fix available 7.1 HighMarch 24, 2026
• linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 more NATS has MQTT plaintext password disclosure CVE-2026-33216 Fix available 8.6 HighMarch 24, 2026
• linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 more NATS Server panic via malicious compression on leafnode port CVE-2026-29785 Fix available 7.5 HighMarch 24, 2026
• linuxfoundation nats-server NATS is vulnerable to MQTT hijacking via Client ID CVE-2026-33215 Fix available 6.5 MediumMarch 24, 2026
• linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 more NATS credentials are exposed in monitoring port via command-line argv CVE-2026-33247 Fix available 7.4 HighMarch 24, 2026
• linuxfoundation nats-server NATS: Message tracing can be redirected to arbitrary subject CVE-2026-33249 Fix available 4.3 MediumMarch 24, 2026
• linuxfoundation nats-server nats-server websockets are vulnerable to pre-auth memory DoS CVE-2026-27571 Fix available 5.9 MediumFebruary 24, 2026
• nats-io nats-server NATS-Server Fails to Authorize Certain Jetstream Admin APIs CVE-2025-30215 Fix available 9.6 CriticalApril 15, 2025
• linuxfoundation nats-server, nats nkeys +1 more xkeys Seal encryption used fixed key for all encryption CVE-2023-46129 Fix available 7.5 HighOctober 30, 2023