nats-io

Products

Exploited and recent CVEs

• CVE-2026-58208 Medium 6.8 NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled 0.6%
• CVE-2026-58211 Medium 5.4 NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions 0.3%
• CVE-2026-58207 High 7.7 NATS Server: Remote crash via integer overflow in Connz pagination 0.6%
• CVE-2026-58210 High 7.5 NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory 0.7%
• CVE-2026-58209 Medium 4.3 NATS Server: MQTT retained and QoS replay bypass subscribe deny filters 0.3%
• CVE-2026-58214 Medium 4.3 NATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217) 0.3%
• CVE-2026-58254 Medium 5.3 NATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission check 0.3%
• CVE-2026-58213 High 7.1 NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection 0.4%
• CVE-2026-58250 High 7.5 NATS Server: Pre-auth server crash via double INFO in leafnode handshake 0.7%
• CVE-2026-58252 Medium 6.5 NATS Server: Subscribe Authz Bypass via Wildcard-Overlap 0.5%
• CVE-2026-58253 High 8.8 NATS Server: Route API Auth Bypass 0.4%
• CVE-2026-58251 Medium 6.5 NATS Server: Queue Subscribe Authz Bypass 0.5%
• CVE-2026-33249 Medium 4.3 NATS: Message tracing can be redirected to arbitrary subject 0.2%
• CVE-2026-33223 Medium 6.4 NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing 0.2%
• CVE-2026-33248 Medium 4.2 NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching 0.1%
• CVE-2026-33222 Medium 4.9 NATS JetStream has an authorization bypass through its Management API 0.3%
• CVE-2026-33247 High 7.4 NATS credentials are exposed in monitoring port via command-line argv 0.4%
• CVE-2026-33219 Medium 5.3 NATS is vulnerable to pre-auth DoS through WebSockets client service 0.5%
• CVE-2026-33218 High 7.5 NATS has pre-auth server panic via leafnode handling 0.6%
• CVE-2026-33246 Medium 6.4 NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers 0.1%
• CVE-2026-33217 High 7.1 NATS allows MQTT clients to bypass ACL checks 0.3%
• CVE-2026-33216 High 8.6 NATS has MQTT plaintext password disclosure 0.4%
• CVE-2026-29785 High 7.5 NATS Server panic via malicious compression on leafnode port 0.7%
• CVE-2026-27889 High 7.5 NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead 0.6%
• CVE-2026-33215 Medium 6.5 NATS is vulnerable to MQTT hijacking via Client ID 0.2%
• CVE-2026-27571 Medium 5.9 nats-server websockets are vulnerable to pre-auth memory DoS 0.5%
• CVE-2025-30215 Critical 9.6 NATS-Server Fails to Authorize Certain Jetstream Admin APIs 0.6%
• CVE-2023-46129 High 7.5 xkeys Seal encryption used fixed key for all encryption 0.4%