GoPackage

github.com/nats-io/nats-server

20 known vulnerabilities (7 high, 9 medium), with the versions each affects and the releases that fix them.

Latest release: v1.4.1 (Feb 7, 2019): affected by 20 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 20 · 7 high, 9 medium

Releases: 25 since v0.5.1 (Apr 25, 2014)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-33249
Affects v0.5.1 to v1.4.1 (through the newest release)
CVE-2026-33223
Affects v0.5.1 to v1.4.1 (through the newest release)
CVE-2026-33248
Affects v0.5.1 to v1.4.1 (through the newest release)
CVE-2026-33222
Affects v0.5.1 to v1.4.1 (through the newest release)
CVE-2026-33247
Affects v0.5.1 to v1.4.1 (through the newest release)
CVE-2026-33219
Affects v0.5.1 to v1.4.1 (through the newest release)
CVE-2026-33218
Affects v0.5.1 to v1.4.1 (through the newest release)
CVE-2026-33246
Affects v0.5.1 to v1.4.1 (through the newest release)
CVE-2026-33217
Affects v0.5.1 to v1.4.1 (through the newest release)
CVE-2026-33216
Affects v0.5.1 to v1.4.1 (through the newest release)
CVE-2026-29785
Affects v0.5.1 to v1.4.1 (through the newest release)
CVE-2026-27889
Affects v0.5.1 to v1.4.1 (through the newest release)

Show all 20 advisoriesShow fewer advisories

CVE-2026-33215
Affects v0.5.1 to v1.4.1 (through the newest release)
CVE-2026-27571
Affects v0.5.1 to v1.4.1 (through the newest release)
CVE-2022-29946
Affects v0.5.1 to v1.4.1 (through the newest release)
CVE-2022-28357
Affects v0.5.1 to v1.4.1 (through the newest release)
CVE-2022-26652
Affects v0.5.1 to v1.4.1 (through the newest release)
CVE-2022-24450
Affects v0.5.1 to v1.4.1 (through the newest release)
CVE-2020-28466
Affects v0.5.1 to v1.4.1 (through the newest release)
CVE-2019-13126
Affects v0.5.1 to v1.4.1 (through the newest release)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 20

CVE-2026-33249Medium 4.3
NATS: Message tracing can be redirected to arbitrary subject
Affected: all versions.
No fix released. The latest release, v1.4.1, is still affected.
CVE-2026-33223Medium 6.4
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing
Affected: all versions.
No fix released. The latest release, v1.4.1, is still affected.
CVE-2026-33248Medium 4.2
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching
Affected: all versions.
No fix released. The latest release, v1.4.1, is still affected.
CVE-2026-33222Medium 4.9
NATS JetStream has an authorization bypass through its Management API
Affected: all versions.
No fix released. The latest release, v1.4.1, is still affected.
CVE-2026-33247High 7.4
NATS credentials are exposed in monitoring port via command-line argv
Affected: all versions.
No fix released. The latest release, v1.4.1, is still affected.
CVE-2026-33219Medium 5.3
NATS is vulnerable to pre-auth DoS through WebSockets client service
Affected: all versions.
No fix released. The latest release, v1.4.1, is still affected.
CVE-2026-33218High 7.5
NATS has pre-auth server panic via leafnode handling
Affected: all versions.
No fix released. The latest release, v1.4.1, is still affected.
CVE-2026-33246Medium 6.4
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers
Affected: all versions.
No fix released. The latest release, v1.4.1, is still affected.
CVE-2026-33217High 7.1
NATS allows MQTT clients to bypass ACL checks
Affected: all versions.
No fix released. The latest release, v1.4.1, is still affected.
CVE-2026-33216High 8.6
NATS has MQTT plaintext password disclosure
Affected: all versions.
No fix released. The latest release, v1.4.1, is still affected.
CVE-2026-29785High 7.5
NATS Server panic via malicious compression on leafnode port
Affected: all versions.
No fix released. The latest release, v1.4.1, is still affected.
CVE-2026-27889High 7.5
NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead
Affected: all versions.
No fix released. The latest release, v1.4.1, is still affected.
CVE-2026-33215Medium 6.5
NATS is vulnerable to MQTT hijacking via Client ID
Affected: all versions.
No fix released. The latest release, v1.4.1, is still affected.
CVE-2026-27571Medium 5.9
nats-server websockets are vulnerable to pre-auth memory DoS
Affected: all versions; through 1.4.1.
No fix released. The latest release, v1.4.1, is still affected.
CVE-2022-29946Medium 6.3
NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused…
Affected: all versions.
No fix released. The latest release, v1.4.1, is still affected.

Show all 20 advisoriesShow fewer advisories

CVE-2022-28357Unrated
NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management…
Affected: from 2.2.0, fixed in 2.7.4; all versions.
No fix released. The latest release, v1.4.1, is still affected.
CVE-2022-26652Unrated
NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams.
Affected: all versions.
No fix released. The latest release, v1.4.1, is still affected.
CVE-2022-24450Unrated
NATS nats-server before 2.7.2 has Incorrect Access Control.
Affected: all versions.
No fix released. The latest release, v1.4.1, is still affected.
CVE-2020-28466High 7.5
Denial of Service (DoS)
Affected: all versions; fixed in 2.2.0.
No fix released. The latest release, v1.4.1, is still affected.
CVE-2019-13126Unrated
An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted request.
Affected: all versions.
No fix released. The latest release, v1.4.1, is still affected.