NA
Product
Nats-server
36
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 16Medium 18Low 0
Watch
Add Nats-server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-58253 | 8.8 | Jul 8 | NATS Server: Route API Auth Bypass Affected: before 2.11.16; 2.12.0 before 2.12.7 |
| CVE-2022-24450 | 8.8 | Feb 8 | NATS nats-server before 2.7.2 has Incorrect Access Control Affected: 2.0.0 before 2.7.2 |
| CVE-2026-58208 | 7.5 | Jul 8 | NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled Affected: 2.12.0 before 2.12.12; 2.14.0 before 2.14.3 |
| CVE-2026-58210 | 7.5 | Jul 8 | NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory Affected: before 2.12.12; 2.14.0 before 2.14.3 |
| CVE-2026-58250 | 7.5 | Jul 8 | NATS Server: Pre-auth server crash via double INFO in leafnode handshake Affected: before 2.11.17; 2.12.0 before 2.12.8 |
| CVE-2026-33218 | 7.5 | Mar 25 | NATS has pre-auth server panic via leafnode handling Affected: before 2.11.15; 2.12.0 before 2.12.6 |
| CVE-2026-33216 | 7.5 | Mar 25 | NATS has MQTT plaintext password disclosure Affected: before 2.11.15; 2.12.0 before 2.12.6 |
| CVE-2026-29785 | 7.5 | Mar 25 | NATS Server panic via malicious compression on leafnode port Affected: before 2.11.14; 2.12.0 before 2.12.5 |
| CVE-2026-27889 | 7.5 | Mar 25 | NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead Affected: 2.2.0 before 2.11.14; 2.12.0 before 2.12.5 |
| CVE-2026-27571 | 7.5 | Feb 24 | nats-server websockets are vulnerable to pre-auth memory DoS Affected: before 2.11.12; 2.12.0 before 2.12.3 |
| CVE-2023-46129 | 7.5 | Oct 31 | NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing Affected: 2.10.0 before 2.10.4 |
| CVE-2021-3127 | 7.5 | Mar 16 | NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled Affected: 2.0.0 before 2.2.0 |
| CVE-2020-28466 | 7.5 | Mar 7 | This affects all versions of package github.com/nats-io/nats-server/server Affected: 2.0.0 before 2.2.0 |
| CVE-2020-26521 | 7.5 | Nov 6 | The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code) Affected: before 2.1.9 |
| CVE-2019-13126 | 7.5 | Jul 29 | An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted request Affected: before 2.0.2 |
| CVE-2026-58213 | 7.1 | Jul 8 | NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection Affected: before 2.12.9; 2.14.0 before 2.14.1 |
Showing 16