Medium severity · published Mar 25, 2026
CVE-2026-33223
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, the NATS message header `Nats-Request-Info:` is supposed to be a guarantee of identity by the NATS server, but the stripping of this header from inbound messages was not fully effective. An attacker with valid credentials for any regular client interface could thus spoof their identity to services which rely upon this header. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NA
nats-server · nats-io
< 2.11.15; >= 2.12.0-RC.1, < 2.12.6 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33223
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-33223
Vendor Advisory
https://advisories.nats.io/CVE/secnote-2026-09.txt
Vendor Advisory
https://github.com/nats-io/nats-server/security/advisories/GHSA-pwx7-fx9r-hr4h
More from nats-server
8.8
CVE-2026-58253
NATS Server: Route API Auth Bypass
7.5
CVE-2026-58208
NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled
7.5
CVE-2026-58210
NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory
7.5
CVE-2026-58250
NATS Server: Pre-auth server crash via double INFO in leafnode handshake
7.5
CVE-2026-33218
NATS has pre-auth server panic via leafnode handling