Login Request a demo
NA
Product
nats-server
by nats-io · last CVE Jul 8, 2026
26
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Vulnerabilities26In the news0Timeline
Severity mix
Critical 0High 10Medium 16Low 0
Severity
All severities26Critical0High10Medium16Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add nats-server to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-58207
6.5
1%
Jul 8
NATS Server: Remote crash via integer overflow in Connz pagination
Affected: < 2.12.12; >= 2.14.0-RC.1, < 2.14.3
CVE-2026-58254
6.5
0%
Jul 8
NATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission check
Affected: < 2.12.8; >= 2.14.0-RC.1, < 2.14.3
CVE-2026-58252
6.5
0%
Jul 8
NATS Server: Subscribe Authz Bypass via Wildcard-Overlap
Affected: < 2.11.16; >= 2.12.0-preview.1, < 2.12.7
CVE-2026-58251
6.5
0%
Jul 8
NATS Server: Queue Subscribe Authz Bypass
Affected: < 2.11.16; >= 2.12.0-RC.1, < 2.12.7
CVE-2026-33217
6.5
0%
Mar 25
NATS allows MQTT clients to bypass ACL checks
Affected: < 2.11.15; >= 2.12.0-RC.1, < 2.12.6
CVE-2026-33215
6.5
0%
Mar 24
NATS is vulnerable to MQTT hijacking via Client ID
Affected: < 2.11.15; >= 2.12.0-RC.1, < 2.12.6
CVE-2026-58211
5.4
0%
Jul 8
NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions
Affected: < 2.12.12; >= 2.14.0-RC.1, < 2.14.3
CVE-2026-33223
5.4
0%
Mar 25
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing
Affected: < 2.11.15; >= 2.12.0-RC.1, < 2.12.6
CVE-2026-33246
5.4
0%
Mar 25
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers
Affected: < 2.11.15; >= 2.12.0-RC.1, < 2.12.6
CVE-2026-33247
5.3
0%
Mar 25
NATS credentials are exposed in monitoring port via command-line argv
Affected: < 2.11.15; >= 2.12.0-RC.1, < 2.12.6
CVE-2026-33219
5.3
1%
Mar 25
NATS is vulnerable to pre-auth DoS through WebSockets client service
Affected: < 2.11.15; >= 2.12.0-RC.1, < 2.12.6
CVE-2026-33222
4.9
0%
Mar 25
NATS JetStream has an authorization bypass through its Management API
Affected: < 2.11.15; >= 2.12.0-RC.1, < 2.12.6
CVE-2026-58209
4.3
0%
Jul 8
NATS Server: MQTT retained and QoS replay bypass subscribe deny filters
Affected: < 2.12.12; >= 2.14.0-RC.1, < 2.14.3
CVE-2026-58214
4.3
0%
Jul 8
NATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217)
Affected: < 2.12.12; >= 2.14.0-RC.1, < 2.14.3
CVE-2026-33249
4.3
0%
Mar 25
NATS: Message tracing can be redirected to arbitrary subject
Affected: >= 2.11.0, < 2.11.15; >= 2.12.0-preview.1, < 2.12.6
CVE-2026-33248
4.2
0%
Mar 25
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching
Affected: < 2.11.15; >= 2.12.0-RC.1, < 2.12.6
Showing 16