Login Request a demo
NA
Product
nats-server
by nats-io · last CVE Jul 8, 2026
26
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Vulnerabilities26In the news0Timeline
Severity mix
Critical 0High 10Medium 16Low 0
Severity
All severities26Critical0High10Medium16Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add nats-server to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-58253
8.8
0%
Jul 8
NATS Server: Route API Auth Bypass
Affected: < 2.11.16; >= 2.12.0-preview.1, < 2.12.6
CVE-2026-58208
7.5
1%
Jul 8
NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled
Affected: >= 2.14.0-RC.1, < 2.14.3; < 2.12.12
CVE-2026-58210
7.5
1%
Jul 8
NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory
Affected: < 2.12.12; >= 2.14.0-RC.1, < 2.14.3
CVE-2026-58250
7.5
1%
Jul 8
NATS Server: Pre-auth server crash via double INFO in leafnode handshake
Affected: < 2.11.17; >= 2.12.0-preview.1, < 2.12.8
CVE-2026-33218
7.5
1%
Mar 25
NATS has pre-auth server panic via leafnode handling
Affected: < < 2.11.15; >= 2.12.0-RC.1, < 2.12.6
CVE-2026-33216
7.5
0%
Mar 25
NATS has MQTT plaintext password disclosure
Affected: < 2.11.15; >= 2.12.0-RC.1, < 2.12.6
CVE-2026-29785
7.5
1%
Mar 25
NATS Server panic via malicious compression on leafnode port
Affected: < 2.11.14; >= 2.12.0-RC.1, < 2.12.5
CVE-2026-27889
7.5
1%
Mar 25
NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead
Affected: >= 2.2.0, < 2.11.14; >= 2.12.0, < 2.12.5
CVE-2026-27571
7.5
1%
Feb 24
nats-server websockets are vulnerable to pre-auth memory DoS
Affected: < 2.11.12; >= 2.12.0-RC.1, < 2.12.3
CVE-2026-58213
7.1
0%
Jul 8
NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection
Affected: < 2.12.9; >= 2.14.0-RC.1, < 2.14.1
Showing 10