# github.com/nats-io/nats-server (Go) vulnerabilities 20 known vulnerabilities (7 high, 9 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v1.4.1 (Feb 7, 2019): affected by 20 advisories - Newest unaffected release: Every release is affected by at least one advisory - Releases: 25 since v0.5.1 (Apr 25, 2014) - Registry: https://pkg.go.dev/github.com/nats-io/nats-server - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-33249: v0.5.1 to v1.4.1 (through the newest release) - CVE-2026-33223: v0.5.1 to v1.4.1 (through the newest release) - CVE-2026-33248: v0.5.1 to v1.4.1 (through the newest release) - CVE-2026-33222: v0.5.1 to v1.4.1 (through the newest release) - CVE-2026-33247: v0.5.1 to v1.4.1 (through the newest release) - CVE-2026-33219: v0.5.1 to v1.4.1 (through the newest release) - CVE-2026-33218: v0.5.1 to v1.4.1 (through the newest release) - CVE-2026-33246: v0.5.1 to v1.4.1 (through the newest release) - CVE-2026-33217: v0.5.1 to v1.4.1 (through the newest release) - CVE-2026-33216: v0.5.1 to v1.4.1 (through the newest release) - CVE-2026-29785: v0.5.1 to v1.4.1 (through the newest release) - CVE-2026-27889: v0.5.1 to v1.4.1 (through the newest release) - CVE-2026-33215: v0.5.1 to v1.4.1 (through the newest release) - CVE-2026-27571: v0.5.1 to v1.4.1 (through the newest release) - CVE-2022-29946: v0.5.1 to v1.4.1 (through the newest release) - CVE-2022-28357: v0.5.1 to v1.4.1 (through the newest release) - CVE-2022-26652: v0.5.1 to v1.4.1 (through the newest release) - CVE-2022-24450: v0.5.1 to v1.4.1 (through the newest release) - CVE-2020-28466: v0.5.1 to v1.4.1 (through the newest release) - CVE-2019-13126: v0.5.1 to v1.4.1 (through the newest release) ## Advisories (20) ### [CVE-2026-33249](https://cve.now/CVE-2026-33249): NATS: Message tracing can be redirected to arbitrary subject - Severity: Medium 4.3 - Published: Mar 25, 2026 - Affected: all versions. - No fix released. The latest release, v1.4.1, is still affected. ### [CVE-2026-33223](https://cve.now/CVE-2026-33223): NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing - Severity: Medium 6.4 - Published: Mar 25, 2026 - Affected: all versions. - No fix released. The latest release, v1.4.1, is still affected. ### [CVE-2026-33248](https://cve.now/CVE-2026-33248): NATS has mTLS verify\_and\_map authentication bypass via incorrect Subject DN matching - Severity: Medium 4.2 - Published: Mar 25, 2026 - Affected: all versions. - No fix released. The latest release, v1.4.1, is still affected. ### [CVE-2026-33222](https://cve.now/CVE-2026-33222): NATS JetStream has an authorization bypass through its Management API - Severity: Medium 4.9 - Published: Mar 25, 2026 - Affected: all versions. - No fix released. The latest release, v1.4.1, is still affected. ### [CVE-2026-33247](https://cve.now/CVE-2026-33247): NATS credentials are exposed in monitoring port via command-line argv - Severity: High 7.4 - Published: Mar 25, 2026 - Affected: all versions. - No fix released. The latest release, v1.4.1, is still affected. ### [CVE-2026-33219](https://cve.now/CVE-2026-33219): NATS is vulnerable to pre-auth DoS through WebSockets client service - Severity: Medium 5.3 - Published: Mar 25, 2026 - Affected: all versions. - No fix released. The latest release, v1.4.1, is still affected. ### [CVE-2026-33218](https://cve.now/CVE-2026-33218): NATS has pre-auth server panic via leafnode handling - Severity: High 7.5 - Published: Mar 25, 2026 - Affected: all versions. - No fix released. The latest release, v1.4.1, is still affected. ### [CVE-2026-33246](https://cve.now/CVE-2026-33246): NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers - Severity: Medium 6.4 - Published: Mar 25, 2026 - Affected: all versions. - No fix released. The latest release, v1.4.1, is still affected. ### [CVE-2026-33217](https://cve.now/CVE-2026-33217): NATS allows MQTT clients to bypass ACL checks - Severity: High 7.1 - Published: Mar 25, 2026 - Affected: all versions. - No fix released. The latest release, v1.4.1, is still affected. ### [CVE-2026-33216](https://cve.now/CVE-2026-33216): NATS has MQTT plaintext password disclosure - Severity: High 8.6 - Published: Mar 25, 2026 - Affected: all versions. - No fix released. The latest release, v1.4.1, is still affected. ### [CVE-2026-29785](https://cve.now/CVE-2026-29785): NATS Server panic via malicious compression on leafnode port - Severity: High 7.5 - Published: Mar 25, 2026 - Affected: all versions. - No fix released. The latest release, v1.4.1, is still affected. ### [CVE-2026-27889](https://cve.now/CVE-2026-27889): NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead - Severity: High 7.5 - Published: Mar 25, 2026 - Affected: all versions. - No fix released. The latest release, v1.4.1, is still affected. ### [CVE-2026-33215](https://cve.now/CVE-2026-33215): NATS is vulnerable to MQTT hijacking via Client ID - Severity: Medium 6.5 - Published: Mar 24, 2026 - Affected: all versions. - No fix released. The latest release, v1.4.1, is still affected. ### [CVE-2026-27571](https://cve.now/CVE-2026-27571): nats-server websockets are vulnerable to pre-auth memory DoS - Severity: Medium 5.9 - Published: Feb 24, 2026 - Affected: all versions; through 1.4.1. - No fix released. The latest release, v1.4.1, is still affected. ### [CVE-2022-29946](https://cve.now/CVE-2022-29946): NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused… - Severity: Medium 6.3 - Published: Jul 11, 2024 - Affected: all versions. - No fix released. The latest release, v1.4.1, is still affected. ### [CVE-2022-28357](https://cve.now/CVE-2022-28357): NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management… - Severity: Unrated - Published: Sep 19, 2023 - Affected: from 2.2.0, fixed in 2.7.4; all versions. - No fix released. The latest release, v1.4.1, is still affected. ### [CVE-2022-26652](https://cve.now/CVE-2022-26652): NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams. - Severity: Unrated - Published: Mar 10, 2022 - Affected: all versions. - No fix released. The latest release, v1.4.1, is still affected. ### [CVE-2022-24450](https://cve.now/CVE-2022-24450): NATS nats-server before 2.7.2 has Incorrect Access Control. - Severity: Unrated - Published: Feb 8, 2022 - Affected: all versions. - No fix released. The latest release, v1.4.1, is still affected. ### [CVE-2020-28466](https://cve.now/CVE-2020-28466): Denial of Service (DoS) - Severity: High 7.5 - Published: Mar 7, 2021 - Affected: all versions; fixed in 2.2.0. - No fix released. The latest release, v1.4.1, is still affected. ### [CVE-2019-13126](https://cve.now/CVE-2019-13126): An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted request. - Severity: Unrated - Published: Jul 29, 2019 - Affected: all versions. - No fix released. The latest release, v1.4.1, is still affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/nats-io/nats-server Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.