# github.com/nats-io/nats-server/v2 (Go) vulnerabilities 26 known vulnerabilities (1 critical, 8 high, 9 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v2.15.2 (Oct 26, 2026): no advisory affects it - Newest unaffected release: v2.15.2 (Oct 26, 2026), the latest release - Releases: 294 since v2.0.0 (Jun 5, 2019) - Registry: https://pkg.go.dev/github.com/nats-io/nats-server/v2 - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-33249: v2.11.0 to v2.11.14 (v2.11.15 is outside it); v2.12.0-preview.1 to v2.12.5 (v2.12.6 is outside it) - CVE-2026-33223: v2.0.0-RC19 to v2.11.14 (v2.11.15 is outside it); v2.12.0-RC.1 to v2.12.5 (v2.12.6 is outside it) - CVE-2026-33248: v2.0.0-RC19 to v2.11.14 (v2.11.15 is outside it); v2.12.0-RC.1 to v2.12.5 (v2.12.6 is outside it) - CVE-2026-33222: v2.0.0-RC19 to v2.11.14 (v2.11.15 is outside it); v2.12.0-RC.1 to v2.12.5 (v2.12.6 is outside it) - CVE-2026-33247: v2.0.0-RC19 to v2.11.14 (v2.11.15 is outside it); v2.12.0-RC.1 to v2.12.5 (v2.12.6 is outside it) - CVE-2026-33219: v2.0.0-RC19 to v2.11.14 (v2.11.15 is outside it); v2.12.0-RC.1 to v2.12.5 (v2.12.6 is outside it) - CVE-2026-33218: v2.0.0-RC19 to v2.11.14 (v2.11.15 is outside it); v2.12.0-RC.1 to v2.12.5 (v2.12.6 is outside it) - CVE-2026-33246: v2.0.0-RC19 to v2.11.14 (v2.11.15 is outside it); v2.12.0-RC.1 to v2.12.5 (v2.12.6 is outside it) - CVE-2026-33217: v2.0.0-RC19 to v2.11.14 (v2.11.15 is outside it); v2.12.0-RC.1 to v2.12.5 (v2.12.6 is outside it) - CVE-2026-33216: v2.0.0-RC19 to v2.11.14 (v2.11.15 is outside it); v2.12.0-RC.1 to v2.12.5 (v2.12.6 is outside it) - CVE-2026-29785: v2.0.0-RC19 to v2.11.12 (v2.11.14 is outside it); v2.12.0-RC.1 to v2.12.5-RC.2 (v2.12.5 is outside it) - CVE-2026-27889: v2.2.0 to v2.11.12 (v2.11.14 is outside it); v2.12.0 to v2.12.5-RC.2 (v2.12.5 is outside it) - CVE-2026-33215: v2.0.0-RC19 to v2.11.14 (v2.11.15 is outside it); v2.12.0-RC.1 to v2.12.5 (v2.12.6 is outside it) - CVE-2026-27571: v2.0.0-RC19 to v2.11.12-RC.7 (v2.11.12 is outside it); v2.12.0-RC.1 to v2.12.3-RC.5 (v2.12.3 is outside it) - CVE-2025-30215: v2.2.0 to v2.10.27-binary (v2.10.27 is outside it); v2.11.0-RC.1 to v2.11.1-binary (v2.11.1 is outside it) - CVE-2022-29946: v2.0.0-RC19 to v2.8.1 (v2.8.2 is outside it) - CVE-2023-46129: v2.10.0 to v2.10.3 (v2.10.4 is outside it) - CVE-2023-47090: v2.2.0 to v2.9.22 (v2.9.23 is outside it); v2.10.0 to v2.10.1 (v2.10.2 is outside it) - CVE-2022-28357: v2.2.0 to v2.7.3 (v2.7.4 is outside it) - CVE-2022-26652: v2.2.0 to v2.7.3 (v2.7.4 is outside it) - CVE-2022-24450: v2.0.0 to v2.7.1 (v2.7.2 is outside it) - CVE-2021-3127: v2.0.0-RC19 to v2.1.9 (v2.2.0 is outside it) - CVE-2020-28466: v2.0.0-RC19 to v2.1.9 (v2.2.0 is outside it) - CVE-2020-26892: v2.0.0-RC19 to v2.1.8 (v2.1.9 is outside it) - CVE-2020-26521: v2.0.0-RC19 to v2.1.8 (v2.1.9 is outside it) - CVE-2019-13126: v2.0.0-RC19 to v2.1.9 (v2.2.0 is outside it) ## Advisories (26) ### [CVE-2026-33249](https://cve.now/CVE-2026-33249): NATS: Message tracing can be redirected to arbitrary subject - Severity: Medium 4.3 - Published: Mar 25, 2026 - Affected: from 2.11.0, fixed in 2.11.15; from 2.12.0-preview.1, fixed in 2.12.6; from 2.11.0, fixed in 2.11.15; from 2.12.0-preview.1, fixed in 2.12.6. - Fixed in v2.11.15 (released Mar 24, 2026, 1 day before disclosure) and v2.12.6 (released Mar 24, 2026, 1 day before disclosure). - The latest release, v2.15.2, is not affected. ### [CVE-2026-33223](https://cve.now/CVE-2026-33223): NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing - Severity: Medium 6.4 - Published: Mar 25, 2026 - Affected: fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6; fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6. - Fixed in v2.11.15 (released Mar 24, 2026, 1 day before disclosure) and v2.12.6 (released Mar 24, 2026, 1 day before disclosure). - The latest release, v2.15.2, is not affected. ### [CVE-2026-33248](https://cve.now/CVE-2026-33248): NATS has mTLS verify\_and\_map authentication bypass via incorrect Subject DN matching - Severity: Medium 4.2 - Published: Mar 25, 2026 - Affected: fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6; fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6. - Fixed in v2.11.15 (released Mar 24, 2026, 1 day before disclosure) and v2.12.6 (released Mar 24, 2026, 1 day before disclosure). - The latest release, v2.15.2, is not affected. ### [CVE-2026-33222](https://cve.now/CVE-2026-33222): NATS JetStream has an authorization bypass through its Management API - Severity: Medium 4.9 - Published: Mar 25, 2026 - Affected: fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6; fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6. - Fixed in v2.11.15 (released Mar 24, 2026, 1 day before disclosure) and v2.12.6 (released Mar 24, 2026, 1 day before disclosure). - The latest release, v2.15.2, is not affected. ### [CVE-2026-33247](https://cve.now/CVE-2026-33247): NATS credentials are exposed in monitoring port via command-line argv - Severity: High 7.4 - Published: Mar 25, 2026 - Affected: fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6; fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6. - Fixed in v2.11.15 (released Mar 24, 2026, 1 day before disclosure) and v2.12.6 (released Mar 24, 2026, 1 day before disclosure). - The latest release, v2.15.2, is not affected. ### [CVE-2026-33219](https://cve.now/CVE-2026-33219): NATS is vulnerable to pre-auth DoS through WebSockets client service - Severity: Medium 5.3 - Published: Mar 25, 2026 - Affected: fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6; fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6. - Fixed in v2.11.15 (released Mar 24, 2026, 1 day before disclosure) and v2.12.6 (released Mar 24, 2026, 1 day before disclosure). - The latest release, v2.15.2, is not affected. ### [CVE-2026-33218](https://cve.now/CVE-2026-33218): NATS has pre-auth server panic via leafnode handling - Severity: High 7.5 - Published: Mar 25, 2026 - Affected: fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6; fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6. - Fixed in v2.11.15 (released Mar 24, 2026, 1 day before disclosure) and v2.12.6 (released Mar 24, 2026, 1 day before disclosure). - The latest release, v2.15.2, is not affected. ### [CVE-2026-33246](https://cve.now/CVE-2026-33246): NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers - Severity: Medium 6.4 - Published: Mar 25, 2026 - Affected: fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6; fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6. - Fixed in v2.11.15 (released Mar 24, 2026, 1 day before disclosure) and v2.12.6 (released Mar 24, 2026, 1 day before disclosure). - The latest release, v2.15.2, is not affected. ### [CVE-2026-33217](https://cve.now/CVE-2026-33217): NATS allows MQTT clients to bypass ACL checks - Severity: High 7.1 - Published: Mar 25, 2026 - Affected: fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6; fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6. - Fixed in v2.11.15 (released Mar 24, 2026, 1 day before disclosure) and v2.12.6 (released Mar 24, 2026, 1 day before disclosure). - The latest release, v2.15.2, is not affected. ### [CVE-2026-33216](https://cve.now/CVE-2026-33216): NATS has MQTT plaintext password disclosure - Severity: High 8.6 - Published: Mar 25, 2026 - Affected: fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6; fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6. - Fixed in v2.11.15 (released Mar 24, 2026, 1 day before disclosure) and v2.12.6 (released Mar 24, 2026, 1 day before disclosure). - The latest release, v2.15.2, is not affected. ### [CVE-2026-29785](https://cve.now/CVE-2026-29785): NATS Server panic via malicious compression on leafnode port - Severity: High 7.5 - Published: Mar 25, 2026 - Affected: fixed in 2.11.14; from 2.12.0-RC.1, fixed in 2.12.5; fixed in 2.11.14; from 2.12.0-RC.1, fixed in 2.12.5. - Fixed in v2.11.14 (released Mar 9, 2026, 16 days before disclosure) and v2.12.5 (released Mar 9, 2026, 16 days before disclosure). - The latest release, v2.15.2, is not affected. ### [CVE-2026-27889](https://cve.now/CVE-2026-27889): NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead - Severity: High 7.5 - Published: Mar 25, 2026 - Affected: from 2.2.0, fixed in 2.11.14; from 2.12.0, fixed in 2.12.5; from 2.2.0, fixed in 2.11.14; from 2.12.0, fixed in 2.12.5. - Fixed in v2.11.14 (released Mar 9, 2026, 16 days before disclosure) and v2.12.5 (released Mar 9, 2026, 16 days before disclosure). - The latest release, v2.15.2, is not affected. ### [CVE-2026-33215](https://cve.now/CVE-2026-33215): NATS is vulnerable to MQTT hijacking via Client ID - Severity: Medium 6.5 - Published: Mar 24, 2026 - Affected: fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6; fixed in 2.11.15; from 2.12.0-RC.1, fixed in 2.12.6. - Fixed in v2.11.15 (released Mar 24, 2026, the day of disclosure) and v2.12.6 (released Mar 24, 2026, the day of disclosure). - The latest release, v2.15.2, is not affected. ### [CVE-2026-27571](https://cve.now/CVE-2026-27571): nats-server websockets are vulnerable to pre-auth memory DoS - Severity: Medium 5.9 - Published: Feb 24, 2026 - Affected: fixed in 2.11.12; from 2.12.0-RC.1, fixed in 2.12.3; fixed in 2.11.12; from 2.12.0-RC.1, fixed in 2.12.3. - Fixed in v2.11.12 (released Jan 27, 2026, 28 days before disclosure) and v2.12.3 (released Dec 17, 2025, 69 days before disclosure). - The latest release, v2.15.2, is not affected. ### [CVE-2025-30215](https://cve.now/CVE-2025-30215): NATS-Server Fails to Authorize Certain Jetstream Admin APIs - Severity: Critical 9.6 - Published: Apr 15, 2025 - Affected: from 2.2.0, fixed in 2.10.27; from 2.11.0, fixed in 2.11.1; from 2.11.0-RC.1, fixed in 2.11.1; from 2.2.0, fixed in 2.10.27. - Fixed in v2.10.27 (released Apr 8, 2025, 7 days before disclosure) and v2.11.1 (released Apr 8, 2025, 7 days before disclosure). - The latest release, v2.15.2, is not affected. ### [CVE-2022-29946](https://cve.now/CVE-2022-29946): NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused… - Severity: Medium 6.3 - Published: Jul 11, 2024 - Affected: fixed in 2.8.2. - Fixed in v2.8.2 (released May 4, 2022, 799 days before disclosure). - The latest release, v2.15.2, is not affected. ### [CVE-2023-46129](https://cve.now/CVE-2023-46129): xkeys Seal encryption used fixed key for all encryption - Severity: High 7.5 - Published: Oct 30, 2023 - Affected: from 2.10.0, fixed in 2.10.4. - Fixed in v2.10.4 (released Oct 27, 2023, 3 days before disclosure). - The latest release, v2.15.2, is not affected. ### [CVE-2023-47090](https://cve.now/CVE-2023-47090): NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. - Severity: Unrated - Published: Oct 30, 2023 - Affected: from 2.2.0, fixed in 2.9.23; from 2.10.0, fixed in 2.10.2; from 2.2.0, fixed in 2.9.23; from 2.10.0, fixed in 2.10.2. - Fixed in v2.9.23 (released Oct 12, 2023, 18 days before disclosure) and v2.10.2 (released Oct 6, 2023, 24 days before disclosure). - The latest release, v2.15.2, is not affected. ### [CVE-2022-28357](https://cve.now/CVE-2022-28357): NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management… - Severity: Unrated - Published: Sep 19, 2023 - Affected: from 2.2.0, fixed in 2.7.4. - Fixed in v2.7.4 (released Mar 9, 2022, 559 days before disclosure). - The latest release, v2.15.2, is not affected. ### [CVE-2022-26652](https://cve.now/CVE-2022-26652): NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams. - Severity: Unrated - Published: Mar 10, 2022 - Affected: from 2.2.0, fixed in 2.7.4. - Fixed in v2.7.4 (released Mar 9, 2022, 1 day before disclosure). - The latest release, v2.15.2, is not affected. ### [CVE-2022-24450](https://cve.now/CVE-2022-24450): NATS nats-server before 2.7.2 has Incorrect Access Control. - Severity: Unrated - Published: Feb 8, 2022 - Affected: from 2.0.0, fixed in 2.7.2. - Fixed in v2.7.2 (released Feb 4, 2022, 4 days before disclosure). - The latest release, v2.15.2, is not affected. ### [CVE-2021-3127](https://cve.now/CVE-2021-3127): NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled. - Severity: Unrated - Published: Mar 16, 2021 - Affected: fixed in 2.2.0. - Fixed in v2.2.0 (released Mar 15, 2021, 1 day before disclosure). - The latest release, v2.15.2, is not affected. ### [CVE-2020-28466](https://cve.now/CVE-2020-28466): Denial of Service (DoS) - Severity: High 7.5 - Published: Mar 7, 2021 - Affected: fixed in 2.2.0. - Fixed in v2.2.0 (released Mar 15, 2021, 8 days after disclosure). - The latest release, v2.15.2, is not affected. ### [CVE-2020-26892](https://cve.now/CVE-2020-26892): The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled. - Severity: Unrated - Published: Nov 6, 2020 - Affected: fixed in 2.1.9. - Fixed in v2.1.9 (released Nov 2, 2020, 4 days before disclosure). - The latest release, v2.15.2, is not affected. ### [CVE-2020-26521](https://cve.now/CVE-2020-26521): The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code). - Severity: Unrated - Published: Nov 6, 2020 - Affected: fixed in 2.1.9. - Fixed in v2.1.9 (released Nov 2, 2020, 4 days before disclosure). - The latest release, v2.15.2, is not affected. ### [CVE-2019-13126](https://cve.now/CVE-2019-13126): An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted request. - Severity: Unrated - Published: Jul 29, 2019 - Affected: fixed in 2.2.0. - Fixed in v2.2.0 (released Mar 15, 2021, 595 days after disclosure). - The latest release, v2.15.2, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/nats-io/nats-server/v2 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.