GoPackage

github.com/nats-io/nats-server/v2

26 known vulnerabilities (1 critical, 8 high, 9 medium), with the versions each affects and the releases that fix them.

Latest release: v2.15.2 (Oct 26, 2026): no advisory affects it
Newest unaffected release: v2.15.2 (Oct 26, 2026), the latest release
Advisories: 26 · 1 critical, 8 high, 9 medium

Releases: 294 since v2.0.0 (Jun 5, 2019)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-33249
Affects v2.11.0 to v2.11.14 (v2.11.15 is outside it); v2.12.0-preview.1 to v2.12.5 (v2.12.6 is outside it)
CVE-2026-33223
Affects v2.0.0-RC19 to v2.11.14 (v2.11.15 is outside it); v2.12.0-RC.1 to v2.12.5 (v2.12.6 is outside it)
CVE-2026-33248
Affects v2.0.0-RC19 to v2.11.14 (v2.11.15 is outside it); v2.12.0-RC.1 to v2.12.5 (v2.12.6 is outside it)
CVE-2026-33222
Affects v2.0.0-RC19 to v2.11.14 (v2.11.15 is outside it); v2.12.0-RC.1 to v2.12.5 (v2.12.6 is outside it)
CVE-2026-33247
Affects v2.0.0-RC19 to v2.11.14 (v2.11.15 is outside it); v2.12.0-RC.1 to v2.12.5 (v2.12.6 is outside it)
CVE-2026-33219
Affects v2.0.0-RC19 to v2.11.14 (v2.11.15 is outside it); v2.12.0-RC.1 to v2.12.5 (v2.12.6 is outside it)
CVE-2026-33218
Affects v2.0.0-RC19 to v2.11.14 (v2.11.15 is outside it); v2.12.0-RC.1 to v2.12.5 (v2.12.6 is outside it)
CVE-2026-33246
Affects v2.0.0-RC19 to v2.11.14 (v2.11.15 is outside it); v2.12.0-RC.1 to v2.12.5 (v2.12.6 is outside it)
CVE-2026-33217
Affects v2.0.0-RC19 to v2.11.14 (v2.11.15 is outside it); v2.12.0-RC.1 to v2.12.5 (v2.12.6 is outside it)
CVE-2026-33216
Affects v2.0.0-RC19 to v2.11.14 (v2.11.15 is outside it); v2.12.0-RC.1 to v2.12.5 (v2.12.6 is outside it)
CVE-2026-29785
Affects v2.0.0-RC19 to v2.11.12 (v2.11.14 is outside it); v2.12.0-RC.1 to v2.12.5-RC.2 (v2.12.5 is outside it)
CVE-2026-27889
Affects v2.2.0 to v2.11.12 (v2.11.14 is outside it); v2.12.0 to v2.12.5-RC.2 (v2.12.5 is outside it)

Show all 26 advisoriesShow fewer advisories

CVE-2026-33215
Affects v2.0.0-RC19 to v2.11.14 (v2.11.15 is outside it); v2.12.0-RC.1 to v2.12.5 (v2.12.6 is outside it)
CVE-2026-27571
Affects v2.0.0-RC19 to v2.11.12-RC.7 (v2.11.12 is outside it); v2.12.0-RC.1 to v2.12.3-RC.5 (v2.12.3 is outside it)
CVE-2025-30215
Affects v2.2.0 to v2.10.27-binary (v2.10.27 is outside it); v2.11.0-RC.1 to v2.11.1-binary (v2.11.1 is outside it)
CVE-2022-29946
Affects v2.0.0-RC19 to v2.8.1 (v2.8.2 is outside it)
CVE-2023-46129
Affects v2.10.0 to v2.10.3 (v2.10.4 is outside it)
CVE-2023-47090
Affects v2.2.0 to v2.9.22 (v2.9.23 is outside it); v2.10.0 to v2.10.1 (v2.10.2 is outside it)
CVE-2022-28357
Affects v2.2.0 to v2.7.3 (v2.7.4 is outside it)
CVE-2022-26652
Affects v2.2.0 to v2.7.3 (v2.7.4 is outside it)
CVE-2022-24450
Affects v2.0.0 to v2.7.1 (v2.7.2 is outside it)
CVE-2021-3127
Affects v2.0.0-RC19 to v2.1.9 (v2.2.0 is outside it)
CVE-2020-28466
Affects v2.0.0-RC19 to v2.1.9 (v2.2.0 is outside it)
CVE-2020-26892
Affects v2.0.0-RC19 to v2.1.8 (v2.1.9 is outside it)
CVE-2020-26521
Affects v2.0.0-RC19 to v2.1.8 (v2.1.9 is outside it)
CVE-2019-13126
Affects v2.0.0-RC19 to v2.1.9 (v2.2.0 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 26

CVE-2026-33249Medium 4.3
NATS: Message tracing can be redirected to arbitrary subject
Affected: from 2.11.0, fixed in 2.11.15; from 2.12.0-preview.1, fixed in 2.12.6; from 2.11.0, fixed in 2.11.15; from 2.12.0-preview.1, fixed in 2.12.6.
Fixed in v2.11.15 (released Mar 24, 2026, 1 day before disclosure) and v2.12.6 (released Mar 24, 2026, 1 day before disclosure).
The latest release, v2.15.2, is not affected.
CVE-2026-33223Medium 6.4
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing
Affected: fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6; fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6.
Fixed in v2.11.15 (released Mar 24, 2026, 1 day before disclosure) and v2.12.6 (released Mar 24, 2026, 1 day before disclosure).
The latest release, v2.15.2, is not affected.
CVE-2026-33248Medium 4.2
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching
Affected: fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6; fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6.
Fixed in v2.11.15 (released Mar 24, 2026, 1 day before disclosure) and v2.12.6 (released Mar 24, 2026, 1 day before disclosure).
The latest release, v2.15.2, is not affected.
CVE-2026-33222Medium 4.9
NATS JetStream has an authorization bypass through its Management API
Affected: fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6; fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6.
Fixed in v2.11.15 (released Mar 24, 2026, 1 day before disclosure) and v2.12.6 (released Mar 24, 2026, 1 day before disclosure).
The latest release, v2.15.2, is not affected.
CVE-2026-33247High 7.4
NATS credentials are exposed in monitoring port via command-line argv
Affected: fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6; fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6.
Fixed in v2.11.15 (released Mar 24, 2026, 1 day before disclosure) and v2.12.6 (released Mar 24, 2026, 1 day before disclosure).
The latest release, v2.15.2, is not affected.
CVE-2026-33219Medium 5.3
NATS is vulnerable to pre-auth DoS through WebSockets client service
Affected: fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6; fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6.
Fixed in v2.11.15 (released Mar 24, 2026, 1 day before disclosure) and v2.12.6 (released Mar 24, 2026, 1 day before disclosure).
The latest release, v2.15.2, is not affected.
CVE-2026-33218High 7.5
NATS has pre-auth server panic via leafnode handling
Affected: fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6; fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6.
Fixed in v2.11.15 (released Mar 24, 2026, 1 day before disclosure) and v2.12.6 (released Mar 24, 2026, 1 day before disclosure).
The latest release, v2.15.2, is not affected.
CVE-2026-33246Medium 6.4
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers
Affected: fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6; fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6.
Fixed in v2.11.15 (released Mar 24, 2026, 1 day before disclosure) and v2.12.6 (released Mar 24, 2026, 1 day before disclosure).
The latest release, v2.15.2, is not affected.
CVE-2026-33217High 7.1
NATS allows MQTT clients to bypass ACL checks
Affected: fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6; fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6.
Fixed in v2.11.15 (released Mar 24, 2026, 1 day before disclosure) and v2.12.6 (released Mar 24, 2026, 1 day before disclosure).
The latest release, v2.15.2, is not affected.
CVE-2026-33216High 8.6
NATS has MQTT plaintext password disclosure
Affected: fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6; fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6.
Fixed in v2.11.15 (released Mar 24, 2026, 1 day before disclosure) and v2.12.6 (released Mar 24, 2026, 1 day before disclosure).
The latest release, v2.15.2, is not affected.
CVE-2026-29785High 7.5
NATS Server panic via malicious compression on leafnode port
Affected: fixed in 2.11.14; from 2.12.0-RC.1, fixed in 2.12.5; fixed in 2.11.14; from 2.12.0-RC.1, fixed in 2.12.5.
Fixed in v2.11.14 (released Mar 9, 2026, 16 days before disclosure) and v2.12.5 (released Mar 9, 2026, 16 days before disclosure).
The latest release, v2.15.2, is not affected.
CVE-2026-27889High 7.5
NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead
Affected: from 2.2.0, fixed in 2.11.14; from 2.12.0, fixed in 2.12.5; from 2.2.0, fixed in 2.11.14; from 2.12.0, fixed in 2.12.5.
Fixed in v2.11.14 (released Mar 9, 2026, 16 days before disclosure) and v2.12.5 (released Mar 9, 2026, 16 days before disclosure).
The latest release, v2.15.2, is not affected.
CVE-2026-33215Medium 6.5
NATS is vulnerable to MQTT hijacking via Client ID
Affected: fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6; fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6.
Fixed in v2.11.15 (released Mar 24, 2026, the day of disclosure) and v2.12.6 (released Mar 24, 2026, the day of disclosure).
The latest release, v2.15.2, is not affected.
CVE-2026-27571Medium 5.9
nats-server websockets are vulnerable to pre-auth memory DoS
Affected: fixed in 2.11.12; from 2.12.0-RC.1, fixed in 2.12.3; fixed in 2.11.12; from 2.12.0-RC.1, fixed in 2.12.3.
Fixed in v2.11.12 (released Jan 27, 2026, 28 days before disclosure) and v2.12.3 (released Dec 17, 2025, 69 days before disclosure).
The latest release, v2.15.2, is not affected.
CVE-2025-30215Critical 9.6
NATS-Server Fails to Authorize Certain Jetstream Admin APIs
Affected: from 2.2.0, fixed in 2.10.27; from 2.11.0, fixed in 2.11.1; from 2.11.0-RC.1, fixed in 2.11.1; from 2.2.0, fixed in 2.10.27.
Fixed in v2.10.27 (released Apr 8, 2025, 7 days before disclosure) and v2.11.1 (released Apr 8, 2025, 7 days before disclosure).
The latest release, v2.15.2, is not affected.

Show all 26 advisoriesShow fewer advisories

CVE-2022-29946Medium 6.3
NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused…
Affected: fixed in 2.8.2.
Fixed in v2.8.2 (released May 4, 2022, 799 days before disclosure).
The latest release, v2.15.2, is not affected.
CVE-2023-46129High 7.5
xkeys Seal encryption used fixed key for all encryption
Affected: from 2.10.0, fixed in 2.10.4.
Fixed in v2.10.4 (released Oct 27, 2023, 3 days before disclosure).
The latest release, v2.15.2, is not affected.
CVE-2023-47090Unrated
NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass.
Affected: from 2.2.0, fixed in 2.9.23; from 2.10.0, fixed in 2.10.2; from 2.2.0, fixed in 2.9.23; from 2.10.0, fixed in 2.10.2.
Fixed in v2.9.23 (released Oct 12, 2023, 18 days before disclosure) and v2.10.2 (released Oct 6, 2023, 24 days before disclosure).
The latest release, v2.15.2, is not affected.
CVE-2022-28357Unrated
NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management…
Affected: from 2.2.0, fixed in 2.7.4.
Fixed in v2.7.4 (released Mar 9, 2022, 559 days before disclosure).
The latest release, v2.15.2, is not affected.
CVE-2022-26652Unrated
NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams.
Affected: from 2.2.0, fixed in 2.7.4.
Fixed in v2.7.4 (released Mar 9, 2022, 1 day before disclosure).
The latest release, v2.15.2, is not affected.
CVE-2022-24450Unrated
NATS nats-server before 2.7.2 has Incorrect Access Control.
Affected: from 2.0.0, fixed in 2.7.2.
Fixed in v2.7.2 (released Feb 4, 2022, 4 days before disclosure).
The latest release, v2.15.2, is not affected.
CVE-2021-3127Unrated
NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled.
Affected: fixed in 2.2.0.
Fixed in v2.2.0 (released Mar 15, 2021, 1 day before disclosure).
The latest release, v2.15.2, is not affected.
CVE-2020-28466High 7.5
Denial of Service (DoS)
Affected: fixed in 2.2.0.
Fixed in v2.2.0 (released Mar 15, 2021, 8 days after disclosure).
The latest release, v2.15.2, is not affected.
CVE-2020-26892Unrated
The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled.
Affected: fixed in 2.1.9.
Fixed in v2.1.9 (released Nov 2, 2020, 4 days before disclosure).
The latest release, v2.15.2, is not affected.
CVE-2020-26521Unrated
The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code).
Affected: fixed in 2.1.9.
Fixed in v2.1.9 (released Nov 2, 2020, 4 days before disclosure).
The latest release, v2.15.2, is not affected.
CVE-2019-13126Unrated
An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted request.
Affected: fixed in 2.2.0.
Fixed in v2.2.0 (released Mar 15, 2021, 595 days after disclosure).
The latest release, v2.15.2, is not affected.