NA
Product
Nats-server
36
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 16Medium 18Low 0
Watch
Add Nats-server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-58207 | 6.5 | Jul 8 | NATS Server: Remote crash via integer overflow in Connz pagination Affected: 2.12.0 before 2.12.12; 2.14.0 before 2.14.3 |
| CVE-2026-58254 | 6.5 | Jul 8 | NATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission check Affected: before 2.12.8; 2.14.0 before 2.14.3 |
| CVE-2026-58252 | 6.5 | Jul 8 | NATS Server: Subscribe Authz Bypass via Wildcard-Overlap Affected: before 2.11.16; 2.12.0 before 2.12.7 |
| CVE-2026-58251 | 6.5 | Jul 8 | NATS Server: Queue Subscribe Authz Bypass Affected: before 2.11.16; 2.12.0 before 2.12.7 |
| CVE-2026-33217 | 6.5 | Mar 25 | NATS allows MQTT clients to bypass ACL checks Affected: before 2.11.15; 2.12.0 before 2.12.6 |
| CVE-2026-33215 | 6.5 | Mar 24 | NATS is vulnerable to MQTT hijacking via Client ID Affected: 2.0.0 before 2.11.15; 2.12.0 before 2.12.5 |
| CVE-2023-47090 | 6.5 | Oct 30 | NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass Affected: 2.2.0 before 2.9.23; 2.10.0 before 2.10.2 |
| CVE-2022-26652 | 6.5 | Mar 10 | NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams Affected: 2.2.0 before 2.7.4 |
| CVE-2026-58211 | 5.4 | Jul 8 | NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions Affected: 2.12.0 before 2.12.12; 2.14.0 before 2.14.3 |
| CVE-2026-33223 | 5.4 | Mar 25 | NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing Affected: before 2.11.15; 2.12.0 before 2.12.6 |
| CVE-2026-33246 | 5.4 | Mar 25 | NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers Affected: before 2.11.15; 2.12.0 before 2.12.6 |
| CVE-2026-33247 | 5.3 | Mar 25 | NATS credentials are exposed in monitoring port via command-line argv Affected: before 2.11.15; 2.12.0 before 2.12.6 |
| CVE-2026-33219 | 5.3 | Mar 25 | NATS is vulnerable to pre-auth DoS through WebSockets client service Affected: before 2.11.15; 2.12.0 before 2.12.6 |
| CVE-2026-33222 | 4.9 | Mar 25 | NATS JetStream has an authorization bypass through its Management API Affected: before 2.11.15; 2.12.0 before 2.12.6 |
| CVE-2026-58209 | 4.3 | Jul 8 | NATS Server: MQTT retained and QoS replay bypass subscribe deny filters Affected: before 2.12.12; 2.14.0 before 2.14.3 |
| CVE-2026-58214 | 4.3 | Jul 8 | NATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217) Affected: before 2.12.12; 2.14.0 before 2.14.3 |
| CVE-2026-33249 | 4.3 | Mar 25 | NATS: Message tracing can be redirected to arbitrary subject Affected: 2.11.0 before 2.11.15; 2.12.0 before 2.12.6 |
| CVE-2026-33248 | 4.2 | Mar 25 | NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching Affected: before 2.11.15; 2.12.0 before 2.12.6 |
Showing 18