Skip to contentNats-io Nats-server vulnerabilities
- linuxfoundation nats-serverNATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is EnabledCVE-2026-58208Fix available6.8 Medium
- linuxfoundation nats-serverNATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictionsCVE-2026-58211Fix available5.4 Medium
- linuxfoundation nats-serverNATS Server: Remote crash via integer overflow in Connz paginationCVE-2026-58207Fix available7.7 High
- linuxfoundation nats-serverNATS Server: MQTT partial CONNECT packets can exhaust pre-auth memoryCVE-2026-58210Fix available7.5 High
- linuxfoundation nats-serverNATS Server: MQTT retained and QoS replay bypass subscribe deny filtersCVE-2026-58209Fix available4.3 Medium
- linuxfoundation nats-serverNATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217)CVE-2026-58214Fix available4.3 Medium
- linuxfoundation nats-serverNATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission checkCVE-2026-58254Fix available5.3 Medium
- linuxfoundation nats-serverNATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injectionCVE-2026-58213Fix available7.1 High
- linuxfoundation nats-serverNATS Server: Pre-auth server crash via double INFO in leafnode handshakeCVE-2026-58250Fix available7.5 High
- linuxfoundation nats-serverNATS Server: Subscribe Authz Bypass via Wildcard-OverlapCVE-2026-58252Fix available6.5 Medium
- linuxfoundation nats-serverNATS Server: Route API Auth BypassCVE-2026-58253Fix available8.8 High
- linuxfoundation nats-serverNATS Server: Queue Subscribe Authz BypassCVE-2026-58251Fix available6.5 Medium
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS: Pre-auth remote server crash via WebSocket frame length overflow in wsReadCVE-2026-27889Fix available7.5 High
- linuxfoundation nats-serverNATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matchingCVE-2026-33248Fix available4.2 Medium
- linuxfoundation nats-serverNATS: Leafnode connections allow spoofing of Nats-Request-Info identity headersCVE-2026-33246Fix available6.4 Medium
- linuxfoundation nats-serverNATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity SpoofingCVE-2026-33223Fix available6.4 Medium
- linuxfoundation nats-serverNATS JetStream has an authorization bypass through its Management APICVE-2026-33222Fix available4.9 Medium
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS is vulnerable to pre-auth DoS through WebSockets client serviceCVE-2026-33219Fix available5.3 Medium
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS has pre-auth server panic via leafnode handlingCVE-2026-33218Fix available7.5 High
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS allows MQTT clients to bypass ACL checksCVE-2026-33217Fix available7.1 High
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS has MQTT plaintext password disclosureCVE-2026-33216Fix available8.6 High
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS Server panic via malicious compression on leafnode portCVE-2026-29785Fix available7.5 High
- linuxfoundation nats-serverNATS is vulnerable to MQTT hijacking via Client IDCVE-2026-33215Fix available6.5 Medium
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS credentials are exposed in monitoring port via command-line argvCVE-2026-33247Fix available7.4 High
- linuxfoundation nats-serverNATS: Message tracing can be redirected to arbitrary subjectCVE-2026-33249Fix available4.3 Medium
- linuxfoundation nats-servernats-server websockets are vulnerable to pre-auth memory DoSCVE-2026-27571Fix available5.9 Medium
- nats-io nats-serverNATS-Server Fails to Authorize Certain Jetstream Admin APIsCVE-2025-30215Fix available9.6 Critical