nats-io nats-server
27 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-58208 | >= 2.14.0-RC.1, < 2.14.3 ; < 2.12.12 | NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled | HIGH 7.5 | 0.6 % | ||
| CVE-2026-58211 | < 2.12.12 ; >= 2.14.0-RC.1, < 2.14.3 | NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-58207 | < 2.12.12 ; >= 2.14.0-RC.1, < 2.14.3 | NATS Server: Remote crash via integer overflow in Connz pagination | HIGH 7.7 | 0.6 % | ||
| CVE-2026-58210 | < 2.12.12 ; >= 2.14.0-RC.1, < 2.14.3 | NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory | HIGH 7.5 | 0.7 % | ||
| CVE-2026-58209 | < 2.12.12 ; >= 2.14.0-RC.1, < 2.14.3 | NATS Server: MQTT retained and QoS replay bypass subscribe deny filters | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-58214 | < 2.12.12 ; >= 2.14.0-RC.1, < 2.14.3 | NATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217) | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-58254 | < 2.12.8 ; >= 2.14.0-RC.1, < 2.14.3 | NATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission check | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-58213 | < 2.12.9 ; >= 2.14.0-RC.1, < 2.14.1 | NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection | HIGH 7.1 | 0.4 % | ||
| CVE-2026-58250 | < 2.11.17 ; >= 2.12.0-preview.1, < 2.12.8 | NATS Server: Pre-auth server crash via double INFO in leafnode handshake | HIGH 7.5 | 0.7 % | ||
| CVE-2026-58252 | < 2.11.16 ; >= 2.12.0-preview.1, < 2.12.7 | NATS Server: Subscribe Authz Bypass via Wildcard-Overlap | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-58253 | < 2.11.16 ; >= 2.12.0-preview.1, < 2.12.6 | NATS Server: Route API Auth Bypass | HIGH 8.8 | 0.4 % | ||
| CVE-2026-58251 | < 2.11.16 ; >= 2.12.0-RC.1, < 2.12.7 | NATS Server: Queue Subscribe Authz Bypass | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-33249 | >= 2.11.0, < 2.11.15 ; >= 2.12.0-preview.1, < 2.12.6 | NATS: Message tracing can be redirected to arbitrary subject | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-33223 | < 2.11.15 ; >= 2.12.0-RC.1, < 2.12.6 | NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing | MEDIUM 6.4 | 0.2 % | ||
| CVE-2026-33248 | < 2.11.15 ; >= 2.12.0-RC.1, < 2.12.6 | NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching | MEDIUM 4.2 | 0.1 % | ||
| CVE-2026-33222 | < 2.11.15 ; >= 2.12.0-RC.1, < 2.12.6 | NATS JetStream has an authorization bypass through its Management API | MEDIUM 4.9 | 0.3 % | ||
| CVE-2026-33247 | < 2.11.15 ; >= 2.12.0-RC.1, < 2.12.6 | NATS credentials are exposed in monitoring port via command-line argv | HIGH 7.4 | 0.4 % | ||
| CVE-2026-33219 | < 2.11.15 ; >= 2.12.0-RC.1, < 2.12.6 | NATS is vulnerable to pre-auth DoS through WebSockets client service | HIGH 7.5 | 0.5 % | ||
| CVE-2026-33218 | < < 2.11.15 ; >= 2.12.0-RC.1, < 2.12.6 | NATS has pre-auth server panic via leafnode handling | HIGH 7.5 | 0.6 % | ||
| CVE-2026-33246 | < 2.11.15 ; >= 2.12.0-RC.1, < 2.12.6 | NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers | MEDIUM 6.4 | 0.1 % | ||
| CVE-2026-33217 | < 2.11.15 ; >= 2.12.0-RC.1, < 2.12.6 | NATS allows MQTT clients to bypass ACL checks | HIGH 7.1 | 0.3 % | ||
| CVE-2026-33216 | < 2.11.15 ; >= 2.12.0-RC.1, < 2.12.6 | NATS has MQTT plaintext password disclosure | HIGH 8.6 | 0.4 % | ||
| CVE-2026-29785 | < 2.11.14 ; >= 2.12.0-RC.1, < 2.12.5 | NATS Server panic via malicious compression on leafnode port | HIGH 7.5 | 0.7 % | ||
| CVE-2026-27889 | >= 2.2.0, < 2.11.14 ; >= 2.12.0, < 2.12.5 | NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead | HIGH 7.5 | 0.6 % | ||
| CVE-2026-33215 | < 2.11.15 ; >= 2.12.0-RC.1, < 2.12.6 | NATS is vulnerable to MQTT hijacking via Client ID | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-27571 | < 2.11.12 ; >= 2.12.0-RC.1, < 2.12.3 | nats-server websockets are vulnerable to pre-auth memory DoS | HIGH 7.5 | 0.5 % | ||
| CVE-2025-30215 | >= 2.2.0, < 2.10.27 ; >= 2.11.0-RC.1, < 2.11.1 | NATS-Server Fails to Authorize Certain Jetstream Admin APIs | CRITICAL 9.6 | 0.6 % |