Nats-io vulnerabilities
28 CVEs and advisories name Nats-io as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-58208NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled
- CVE-2026-58211NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions
- CVE-2026-58207NATS Server: Remote crash via integer overflow in Connz pagination
- CVE-2026-58210NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory
- CVE-2026-58209NATS Server: MQTT retained and QoS replay bypass subscribe deny filters
- CVE-2026-58214NATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217)
- CVE-2026-58254NATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission check
- CVE-2026-58213NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection
- CVE-2026-58250NATS Server: Pre-auth server crash via double INFO in leafnode handshake
- CVE-2026-58252NATS Server: Subscribe Authz Bypass via Wildcard-Overlap
- CVE-2026-58253NATS Server: Route API Auth Bypass
- CVE-2026-58251NATS Server: Queue Subscribe Authz Bypass
- CVE-2026-33249NATS: Message tracing can be redirected to arbitrary subject
- CVE-2026-33223NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing
- CVE-2026-33248NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching
- CVE-2026-33222NATS JetStream has an authorization bypass through its Management API
- CVE-2026-33247NATS credentials are exposed in monitoring port via command-line argv
- CVE-2026-33219NATS is vulnerable to pre-auth DoS through WebSockets client service
- CVE-2026-33218NATS has pre-auth server panic via leafnode handling
- CVE-2026-33246NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers
- CVE-2026-33217NATS allows MQTT clients to bypass ACL checks
- CVE-2026-33216NATS has MQTT plaintext password disclosure
- CVE-2026-29785NATS Server panic via malicious compression on leafnode port
- CVE-2026-27889NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead
- CVE-2026-33215NATS is vulnerable to MQTT hijacking via Client ID
- CVE-2026-27571nats-server websockets are vulnerable to pre-auth memory DoS
- CVE-2025-30215NATS-Server Fails to Authorize Certain Jetstream Admin APIs
- CVE-2023-46129xkeys Seal encryption used fixed key for all encryption