NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account

The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled

NATS Server: Route API Auth Bypass

NATS nats-server before 2.7.2 has Incorrect Access Control

NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled

NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory

NATS Server: Pre-auth server crash via double INFO in leafnode handshake

NATS has pre-auth server panic via leafnode handling

NATS has MQTT plaintext password disclosure

NATS Server panic via malicious compression on leafnode port

NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing

NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled

This affects all versions of package github.com/nats-io/nats-server/server

The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code)

An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted request

NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection

NATS Server: Remote crash via integer overflow in Connz pagination

NATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission check

NATS Server: Subscribe Authz Bypass via Wildcard-Overlap

NATS Server: Queue Subscribe Authz Bypass

NATS allows MQTT clients to bypass ACL checks

NATS is vulnerable to MQTT hijacking via Client ID

NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass

NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams

NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions

NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing

NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers

NATS credentials are exposed in monitoring port via command-line argv

NATS is vulnerable to pre-auth DoS through WebSockets client service

NATS JetStream has an authorization bypass through its Management API

NATS Server: MQTT retained and QoS replay bypass subscribe deny filters

NATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217)

NATS: Message tracing can be redirected to arbitrary subject

NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching