Advisories · Technology
nats-io nats-server.
Every CVE that names nats-io nats-server among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.8 Medium
NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled
- nats-io nats-server
- CWE-248
- CVSS 5.4 Medium
NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions
- nats-io nats-server
- Broken access control
- CVSS 7.7 High
NATS Server: Remote crash via integer overflow in Connz pagination
- nats-io nats-server
- Memory corruption
- CVSS 7.5 High
NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory
- nats-io nats-server
- Denial of service
- CVSS 4.3 Medium
NATS Server: MQTT retained and QoS replay bypass subscribe deny filters
- nats-io nats-server
- Broken access control
- CVSS 4.3 Medium
NATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217)
- nats-io nats-server
- Broken access control
- CVSS 5.3 Medium
NATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission check
- nats-io nats-server
- Broken access control
- CVSS 7.1 High
NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection
- nats-io nats-server
- Other injection
- CVSS 7.5 High
NATS Server: Pre-auth server crash via double INFO in leafnode handshake
- nats-io nats-server
- Memory corruption
- CVSS 6.5 Medium
NATS Server: Subscribe Authz Bypass via Wildcard-Overlap
- nats-io nats-server
- Broken access control
- CVSS 8.8 High
NATS Server: Route API Auth Bypass
- nats-io nats-server
- Authentication bypass
- CVSS 6.5 Medium
NATS Server: Queue Subscribe Authz Bypass
- nats-io nats-server
- Broken access control