Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

nats-server — Vulnerabilities & Security Advisories 27

All 27 CVE vulnerabilities found in nats-server, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerability data for the nats-server product developed by Synadia, focusing primarily on software weaknesses and security flaws. The collection encompasses a wide range of issues including remote code execution, denial of service, and information disclosure vulnerabilities discovered and reported from the initial public release through the most recent maintenance updates. Readers can utilize this resource to track the vendor's security advisories over time, understand the prevalence and impact of specific weakness classes within the NATS messaging system, or review the complete historical vulnerability record for this server software. The data presented here is derived from public security databases and official vendor disclosures to provide a comprehensive view of the security posture without requiring access to proprietary feeds. By centralizing these findings, the page serves as a reference for security professionals, system administrators, and developers responsible for maintaining or deploying nats-server instances in production environments. Users seeking to harden their infrastructure can identify patterns in past exploits to implement more effective defensive measures. This compilation remains strictly factual and technical, avoiding promotional language to ensure clarity and utility for security analysis tasks.

Vendor: nats-io

CVE ID Title CVSS Severity Published
CVE-2026-58208 NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled CWE-248 6.8 Medium 2026-07-08
CVE-2026-58211 NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions CWE-863 5.4 Medium 2026-07-08
CVE-2026-58207 NATS Server: Remote crash via integer overflow in Connz pagination CWE-190 7.7 High 2026-07-08
CVE-2026-58210 NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory CWE-400 7.5 High 2026-07-08
CVE-2026-58209 NATS Server: MQTT retained and QoS replay bypass subscribe deny filters CWE-863 4.3 Medium 2026-07-08
CVE-2026-58214 NATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217) CWE-863 4.3 Medium 2026-07-08
CVE-2026-58254 NATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission check CWE-863 - - 2026-07-08
CVE-2026-58213 NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection CWE-74 7.1 High 2026-07-08
CVE-2026-58250 NATS Server: Pre-auth server crash via double INFO in leafnode handshake CWE-476 7.5 High 2026-07-08
CVE-2026-58252 NATS Server: Subscribe Authz Bypass via Wildcard-Overlap CWE-285 6.5 Medium 2026-07-08
CVE-2026-58253 NATS Server: Route API Auth Bypass CWE-287 8.8 High 2026-07-08
CVE-2026-58251 NATS Server: Queue Subscribe Authz Bypass CWE-285 6.5 Medium 2026-07-08
CVE-2026-33249 NATS: Message tracing can be redirected to arbitrary subject CWE-863 4.3 Medium 2026-03-25
CVE-2026-33223 NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing CWE-290 6.4 Medium 2026-03-25
CVE-2026-33248 NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching CWE-287 4.2 Medium 2026-03-25
CVE-2026-33222 NATS JetStream has an authorization bypass through its Management API CWE-285 4.9 Medium 2026-03-25
CVE-2026-33247 NATS credentials are exposed in monitoring port via command-line argv CWE-215 7.4 High 2026-03-25
CVE-2026-33219 NATS is vulnerable to pre-auth DoS through WebSockets client service CWE-770 5.3 Medium 2026-03-25
CVE-2026-33218 NATS has pre-auth server panic via leafnode handling CWE-20 7.5 High 2026-03-25
CVE-2026-33246 NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers CWE-287 6.4 Medium 2026-03-25
CVE-2026-33217 NATS allows MQTT clients to bypass ACL checks CWE-863 7.1 High 2026-03-25
CVE-2026-33216 NATS has MQTT plaintext password disclosure CWE-256 8.6 High 2026-03-25
CVE-2026-29785 NATS Server panic via malicious compression on leafnode port CWE-476 7.5 High 2026-03-25
CVE-2026-27889 NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead CWE-190 7.5 High 2026-03-25
CVE-2026-33215 NATS is vulnerable to MQTT hijacking via Client ID CWE-287 6.5 Medium 2026-03-24
CVE-2026-27571 nats-server websockets are vulnerable to pre-auth memory DoS CWE-409 5.9 Medium 2026-02-24
CVE-2025-30215 NATS-Server Fails to Authorize Certain Jetstream Admin APIs CWE-306 9.6 Critical 2025-04-15

All 27 known CVE vulnerabilities affecting nats-server with full Chinese analysis, references, and POCs where available.