Advisoriesby Ibis
nats-server security advisories
22 advisories · 6 critical or high in 12 months · latest Mar 26
22 advisories
NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-serverCVE-2026-33215no fix yetNATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-serverCVE-2026-33249no fix yetNATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-serverCVE-2026-33247no fix yetNATS: Pre-auth remote server crash via WebSocket frame length overflow in wsReadCVE-2026-27889no fix yetNATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matchingCVE-2026-33248no fix yetNATS: Leafnode connections allow spoofing of Nats-Request-Info identity headersCVE-2026-33246no fix yetNATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity SpoofingCVE-2026-33223no fix yetNATS JetStream has an authorization bypass through its Management APICVE-2026-33222no fix yetNATS is vulnerable to pre-auth DoS through WebSockets client serviceCVE-2026-33219no fix yetNATS has pre-auth server panic via leafnode handlingCVE-2026-33218no fix yetNATS allows MQTT clients to bypass ACL checksCVE-2026-33217no fix yetNATS has MQTT plaintext password disclosureCVE-2026-33216no fix yetNATS Server panic via malicious compression on leafnode portCVE-2026-29785no fix yetnats-server websockets are vulnerable to pre-auth memory DoSCVE-2026-27571no fix yetInteger Overflow or Wraparound in NATS Server in github.com/nats-io/nats-serverCVE-2019-13126no fix yetImport loops in account imports, nats-server DoS in github.com/nats-io/nats-serverGO-2022-0398no fix yetArbitrary file write in nats-server in github.com/nats-io/nats-serverCVE-2022-26652no fix yetIncorrect Authorization in NATS nats-server in github.com/nats-io/nats-serverCVE-2022-24450no fix yetNATS Server and Streaming Server fails to enforce negative user permissionsCVE-2022-29946no fix yetNATS server TLS missing ciphersuite settings when CLI flags used in github.com/nats-io/nats-serverCVE-2021-32026no fix yetNATS nats-server allows directory traversal via unintended path to a management actionCVE-2022-28357fixed in 2.7.4Denial of service in github.com/nats-io/nats-server/serverCVE-2020-28466fixed in 2.2.0About nats-server
High-Performance server for NATS.io, the cloud and edge native messaging system.
Packages watched: github.com/nats-io/nats-server (Go).