| NATS.io: Adding accounts for just the system account adds auth bypassCVE-2023-47090 · GHSA-FR2G-9HJM-WR23Version ranges need review. |
github.com/nats-io/nats-server/v2 |
Go |
High
|
Fix reported |
|
| Import loops in account imports, nats-server DoSGHSA-GWJ5-3VFQ-Q992 · GO-2022-0398Version ranges need review. |
github.com/nats-io/nats-server/v2github.com/nats-io/nats-server |
Go |
Low
|
Fix reported |
|
| NATS server TLS missing ciphersuite settings when CLI flags usedCVE-2021-32026 · GHSA-JJ54-5Q2M-Q7PJVersion ranges need review. |
github.com/nats-io/nats-server/v2github.com/nats-io/nats-server |
Go |
Low
|
Fix reported |
|
| Integer Overflow or Wraparound in NATS ServerCVE-2019-13126 · GHSA-JP4J-47F9-2VC3Version ranges need review. |
github.com/nats-io/nats-server/v2github.com/nats-io/nats-server |
Go |
High
|
Fix reported |
|
| Denial of service in github.com/nats-io/nats-server/serverCVE-2020-28466 · GHSA-M4JX-6526-VVHMVersion ranges need review. |
github.com/nats-io/nats-server/v2github.com/nats-io/nats-server |
Go |
High
|
Fix reported |
|
| NATS Server may fail to authorize certain Jetstream admin APIsCVE-2025-30215 · GHSA-FHG8-QXH5-7Q3WVersion ranges need review. |
github.com/nats-io/nats-server/v2 |
Go |
Critical
|
Fix reported |
|
| NATS Server panic via malicious compression on leafnode portCVE-2026-29785 · GHSA-52JH-2XXH-PWH6Version ranges need review. |
github.com/nats-io/nats-server/v2github.com/nats-io/nats-server |
Go |
High
|
Fix reported |
|
| NATS: Message tracing can be redirected to arbitrary subjectCVE-2026-33249 · GHSA-8M2X-3M6Q-6W8JVersion ranges need review. |
github.com/nats-io/nats-server/v2github.com/nats-io/nats-server |
GoRed Hat |
Medium
|
Fix reported |
|
| NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matchingCVE-2026-33248 · GHSA-3F24-PCVM-5JQCVersion ranges need review. |
github.com/nats-io/nats-server/v2github.com/nats-io/nats-server |
GoRed Hat |
Medium
|
Fix reported |
|
| NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity SpoofingCVE-2026-33223 · GHSA-PWX7-FX9R-HR4HVersion ranges need review. |
github.com/nats-io/nats-server/v2github.com/nats-io/nats-server |
GoRed Hat |
Medium
|
Fix reported |
|
| NATS JetStream has an authorization bypass through its Management APICVE-2026-33222 · GHSA-9983-VRX2-FG9CVersion ranges need review. |
github.com/nats-io/nats-server/v2github.com/nats-io/nats-server |
GoRed Hat |
Medium
|
Fix reported |
|
| NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headersCVE-2026-33246 · GHSA-55H8-8G96-X4HJVersion ranges need review. |
github.com/nats-io/nats-server/v2github.com/nats-io/nats-server |
GoRed Hat |
Medium
|
Fix reported |
|
| NATS is vulnerable to pre-auth DoS through WebSockets client serviceCVE-2026-33219 · GHSA-8R68-GVR4-JH7JVersion ranges need review. |
github.com/nats-io/nats-server/v2github.com/nats-io/nats-server |
Go |
Medium
|
Fix reported |
|
| NATS has pre-auth server panic via leafnode handlingCVE-2026-33218 · GHSA-VPRV-35VV-Q339Version ranges need review. |
github.com/nats-io/nats-server/v2github.com/nats-io/nats-server |
Go |
High
|
Fix reported |
|
| NATS allows MQTT clients to bypass ACL checksCVE-2026-33217 · GHSA-JXXM-27VP-C3M5Version ranges need review. |
github.com/nats-io/nats-server/v2github.com/nats-io/nats-server |
Go |
High
|
Fix reported |
|
| NATS has MQTT plaintext password disclosureCVE-2026-33216 · GHSA-V722-JCV5-W7MCVersion ranges need review. |
github.com/nats-io/nats-server/v2github.com/nats-io/nats-server |
Go |
High
|
Fix reported |
|
| NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsReadCVE-2026-27889 · GHSA-PQ2Q-RCW4-3HR6Version ranges need review. |
github.com/nats-io/nats-server/v2github.com/nats-io/nats-server |
Go |
High
|
Fix reported |
|
| NATS credentials are exposed in monitoring port via command-line argvCVE-2026-33247 · GHSA-X6G4-F6Q3-FQVVVersion ranges need review. |
github.com/nats-io/nats-server/v2github.com/nats-io/nats-server |
Go |
High
|
Fix reported |
|
| NATS is vulnerable to MQTT hijacking via Client IDCVE-2026-33215 · GHSA-FCJP-H8CC-6879Version ranges need review. |
github.com/nats-io/nats-server/v2github.com/nats-io/nats-server |
Go |
Medium
|
Fix reported |
|
| NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjectsCVE-2022-29946 · GHSA-2H2X-8HH2-MFQ8Version ranges need review. |
github.com/nats-io/nats-server/v2github.com/nats-io/nats-server |
GoRed Hat |
High
|
Fix reported |
|
