github.com/nats-io/nats-server/v2
High-Performance server for NATS.io, the cloud and edge native messaging system.
View on Github
Activity
- Latest release
- 3d ago
- Total releases
- 72
- Cadence
- ~5 days
- Last 12 months
- 33
Reach
- Stars
- 20.7k
Details
- First release
- Mar 31, 2020
| Version | Released | |
|---|---|---|
v2.14.7-RC.1
pre
|
v2.14.7-RC.1
pre
Dependencies (11)
+ 3 more |
|
v2.15.0-RC.1
pre
|
v2.15.0-RC.1
pre
Dependencies (11)
+ 3 more |
|
v2.14.6
patch
|
v2.14.6
patch
Dependencies (11)
+ 3 more |
|
v2.14.6-RC.2
pre
|
v2.14.6-RC.2
pre
Dependencies (11)
+ 3 more |
|
v2.14.6-RC.1
pre
|
v2.14.6-RC.1
pre
Dependencies (11)
+ 3 more |
|
v2.15.0-preview.1
pre
|
v2.15.0-preview.1
pre
Dependencies (11)
+ 3 more |
|
v2.12.15
patch
|
v2.12.15
patch
Dependencies (11)
+ 3 more |
|
v2.14.5
patch
|
v2.14.5
patch
Dependencies (11)
+ 3 more |
|
v2.12.14
patch
|
v2.12.14
patch
Dependencies (11)
+ 3 more |
|
v2.14.4
patch
|
v2.14.4
patch
Dependencies (11)
+ 3 more |
|
v2.12.12
patch
|
v2.12.12
patch
Dependencies (11)
+ 3 more |
|
v2.14.3
patch
|
v2.14.3
patch
Dependencies (11)
+ 3 more |
|
v2.12.11
patch
|
v2.12.11
patch
Dependencies (11)
+ 3 more |
|
v2.12.10
patch
|
v2.12.10
patch
Dependencies (11)
+ 3 more |
|
v2.14.2
patch
|
v2.14.2
patch
Dependencies (11)
+ 3 more |
|
v2.14.2-RC.1
pre
|
v2.14.2-RC.1
pre
Dependencies (11)
+ 3 more |
|
v2.12.10-RC.1
pre
|
v2.12.10-RC.1
pre
Dependencies (11)
+ 3 more |
|
v2.12.9
patch
|
v2.12.9
patch
Dependencies (11)
+ 3 more |
|
v2.14.1
patch
|
v2.14.1
patch
Dependencies (11)
+ 3 more |
|
v2.12.9-RC.2
pre
|
v2.12.9-RC.2
pre
Dependencies (11)
+ 3 more |
|
v2.14.1-RC.2
pre
|
v2.14.1-RC.2
pre
Dependencies (11)
+ 3 more |
|
v2.12.9-RC.1
pre
|
v2.12.9-RC.1
pre
Dependencies (11)
+ 3 more |
|
v2.14.1-RC.1
pre
|
v2.14.1-RC.1
pre
Dependencies (11)
+ 3 more |
|
v2.14.0
minor
|
v2.14.0
minor
Dependencies (11)
+ 3 more |
|
v2.14.0-RC.3
pre
|
v2.14.0-RC.3
pre
Dependencies (11)
+ 3 more |
|
v2.14.0-RC.2
pre
|
v2.14.0-RC.2
pre
Dependencies (11)
+ 3 more |
|
v2.12.8
patch
|
v2.12.8
patch
Dependencies (11)
+ 3 more |
|
v2.14.0-RC.1
pre
|
v2.14.0-RC.1
pre
Dependencies (11)
+ 3 more |
|
v2.12.4
minor
13 CVEs
CVE-2026-33217
GO-2026-4834
BIT-nats-2026-33217
GHSA-jxxm-27vp-c3m5
Mar 26, 2026
NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33215
GO-2026-4833
BIT-nats-2026-33215
GHSA-fcjp-h8cc-6879
Mar 26, 2026
NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33222
GO-2026-4832
BIT-nats-2026-33222
GHSA-9983-vrx2-fg9c
Mar 26, 2026
NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-29785
GO-2026-4829
BIT-nats-2026-29785
GHSA-52jh-2xxh-pwh6
Mar 26, 2026
NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 31, 2026 · Source: OSV.dev
CVE-2026-33216
GO-2026-4836
BIT-nats-2026-33216
GHSA-v722-jcv5-w7mc
Mar 26, 2026
NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33218
GO-2026-4837
BIT-nats-2026-33218
GHSA-vprv-35vv-q339
Mar 26, 2026
NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-27889
GO-2026-4841
BIT-nats-2026-27889
GHSA-pq2q-rcw4-3hr6
Mar 26, 2026
NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33223
GO-2026-4835
BIT-nats-2026-33223
GHSA-pwx7-fx9r-hr4h
Mar 26, 2026
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33246
GO-2026-4830
BIT-nats-2026-33246
GHSA-55h8-8g96-x4hj
Mar 26, 2026
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33219
GO-2026-4831
BIT-nats-2026-33219
GHSA-8r68-gvr4-jh7j
Mar 26, 2026
NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33247
GO-2026-4827
BIT-nats-2026-33247
GHSA-x6g4-f6q3-fqvv
Mar 26, 2026
NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33248
GO-2026-4828
BIT-nats-2026-33248
GHSA-3f24-pcvm-5jqc
Mar 26, 2026
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33249
GO-2026-4826
BIT-nats-2026-33249
GHSA-8m2x-3m6q-6w8j
Mar 26, 2026
NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 30, 2026 · Source: OSV.dev |
v2.12.4
minor
Dependencies (12)
+ 4 more |
|
v2.11.12-RC.1
pre
14 CVEs
CVE-2026-33217
GO-2026-4834
BIT-nats-2026-33217
GHSA-jxxm-27vp-c3m5
Mar 26, 2026
NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33215
GO-2026-4833
BIT-nats-2026-33215
GHSA-fcjp-h8cc-6879
Mar 26, 2026
NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33222
GO-2026-4832
BIT-nats-2026-33222
GHSA-9983-vrx2-fg9c
Mar 26, 2026
NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-29785
GO-2026-4829
BIT-nats-2026-29785
GHSA-52jh-2xxh-pwh6
Mar 26, 2026
NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 31, 2026 · Source: OSV.dev
CVE-2026-33216
GO-2026-4836
BIT-nats-2026-33216
GHSA-v722-jcv5-w7mc
Mar 26, 2026
NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33218
GO-2026-4837
BIT-nats-2026-33218
GHSA-vprv-35vv-q339
Mar 26, 2026
NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-27889
GO-2026-4841
BIT-nats-2026-27889
GHSA-pq2q-rcw4-3hr6
Mar 26, 2026
NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33223
GO-2026-4835
BIT-nats-2026-33223
GHSA-pwx7-fx9r-hr4h
Mar 26, 2026
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33246
GO-2026-4830
BIT-nats-2026-33246
GHSA-55h8-8g96-x4hj
Mar 26, 2026
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33219
GO-2026-4831
BIT-nats-2026-33219
GHSA-8r68-gvr4-jh7j
Mar 26, 2026
NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33247
GO-2026-4827
BIT-nats-2026-33247
GHSA-x6g4-f6q3-fqvv
Mar 26, 2026
NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33248
GO-2026-4828
BIT-nats-2026-33248
GHSA-3f24-pcvm-5jqc
Mar 26, 2026
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33249
GO-2026-4826
BIT-nats-2026-33249
GHSA-8m2x-3m6q-6w8j
Mar 26, 2026
NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 30, 2026 · Source: OSV.dev
CVE-2026-27571
GO-2026-4533
BIT-nats-2026-27571
GHSA-qrvq-68c2-7grw
Feb 25, 2026
nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server Fixed in
2.11.12
2.12.3
References Updated Mar 02, 2026 · Source: OSV.dev |
v2.11.12-RC.1
pre
Dependencies (12)
+ 4 more |
|
v2.12.3-RC.5
pre
14 CVEs
CVE-2026-33217
GO-2026-4834
BIT-nats-2026-33217
GHSA-jxxm-27vp-c3m5
Mar 26, 2026
NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33215
GO-2026-4833
BIT-nats-2026-33215
GHSA-fcjp-h8cc-6879
Mar 26, 2026
NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33222
GO-2026-4832
BIT-nats-2026-33222
GHSA-9983-vrx2-fg9c
Mar 26, 2026
NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-29785
GO-2026-4829
BIT-nats-2026-29785
GHSA-52jh-2xxh-pwh6
Mar 26, 2026
NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 31, 2026 · Source: OSV.dev
CVE-2026-33216
GO-2026-4836
BIT-nats-2026-33216
GHSA-v722-jcv5-w7mc
Mar 26, 2026
NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33218
GO-2026-4837
BIT-nats-2026-33218
GHSA-vprv-35vv-q339
Mar 26, 2026
NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-27889
GO-2026-4841
BIT-nats-2026-27889
GHSA-pq2q-rcw4-3hr6
Mar 26, 2026
NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33223
GO-2026-4835
BIT-nats-2026-33223
GHSA-pwx7-fx9r-hr4h
Mar 26, 2026
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33246
GO-2026-4830
BIT-nats-2026-33246
GHSA-55h8-8g96-x4hj
Mar 26, 2026
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33219
GO-2026-4831
BIT-nats-2026-33219
GHSA-8r68-gvr4-jh7j
Mar 26, 2026
NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33247
GO-2026-4827
BIT-nats-2026-33247
GHSA-x6g4-f6q3-fqvv
Mar 26, 2026
NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33248
GO-2026-4828
BIT-nats-2026-33248
GHSA-3f24-pcvm-5jqc
Mar 26, 2026
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33249
GO-2026-4826
BIT-nats-2026-33249
GHSA-8m2x-3m6q-6w8j
Mar 26, 2026
NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 30, 2026 · Source: OSV.dev
CVE-2026-27571
GO-2026-4533
BIT-nats-2026-27571
GHSA-qrvq-68c2-7grw
Feb 25, 2026
nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server Fixed in
2.11.12
2.12.3
References Updated Mar 02, 2026 · Source: OSV.dev |
v2.12.3-RC.5
pre
Dependencies (12)
+ 4 more |
|
v2.11.11-RC.1
pre
14 CVEs
CVE-2026-33217
GO-2026-4834
BIT-nats-2026-33217
GHSA-jxxm-27vp-c3m5
Mar 26, 2026
NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33215
GO-2026-4833
BIT-nats-2026-33215
GHSA-fcjp-h8cc-6879
Mar 26, 2026
NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33222
GO-2026-4832
BIT-nats-2026-33222
GHSA-9983-vrx2-fg9c
Mar 26, 2026
NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-29785
GO-2026-4829
BIT-nats-2026-29785
GHSA-52jh-2xxh-pwh6
Mar 26, 2026
NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 31, 2026 · Source: OSV.dev
CVE-2026-33216
GO-2026-4836
BIT-nats-2026-33216
GHSA-v722-jcv5-w7mc
Mar 26, 2026
NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33218
GO-2026-4837
BIT-nats-2026-33218
GHSA-vprv-35vv-q339
Mar 26, 2026
NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-27889
GO-2026-4841
BIT-nats-2026-27889
GHSA-pq2q-rcw4-3hr6
Mar 26, 2026
NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33223
GO-2026-4835
BIT-nats-2026-33223
GHSA-pwx7-fx9r-hr4h
Mar 26, 2026
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33246
GO-2026-4830
BIT-nats-2026-33246
GHSA-55h8-8g96-x4hj
Mar 26, 2026
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33219
GO-2026-4831
BIT-nats-2026-33219
GHSA-8r68-gvr4-jh7j
Mar 26, 2026
NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33247
GO-2026-4827
BIT-nats-2026-33247
GHSA-x6g4-f6q3-fqvv
Mar 26, 2026
NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33248
GO-2026-4828
BIT-nats-2026-33248
GHSA-3f24-pcvm-5jqc
Mar 26, 2026
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33249
GO-2026-4826
BIT-nats-2026-33249
GHSA-8m2x-3m6q-6w8j
Mar 26, 2026
NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 30, 2026 · Source: OSV.dev
CVE-2026-27571
GO-2026-4533
BIT-nats-2026-27571
GHSA-qrvq-68c2-7grw
Feb 25, 2026
nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server Fixed in
2.11.12
2.12.3
References Updated Mar 02, 2026 · Source: OSV.dev |
v2.11.11-RC.1
pre
Dependencies (12)
+ 4 more |
|
v2.12.1-RC.3
pre
14 CVEs
CVE-2026-33217
GO-2026-4834
BIT-nats-2026-33217
GHSA-jxxm-27vp-c3m5
Mar 26, 2026
NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33215
GO-2026-4833
BIT-nats-2026-33215
GHSA-fcjp-h8cc-6879
Mar 26, 2026
NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33222
GO-2026-4832
BIT-nats-2026-33222
GHSA-9983-vrx2-fg9c
Mar 26, 2026
NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-29785
GO-2026-4829
BIT-nats-2026-29785
GHSA-52jh-2xxh-pwh6
Mar 26, 2026
NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 31, 2026 · Source: OSV.dev
CVE-2026-33216
GO-2026-4836
BIT-nats-2026-33216
GHSA-v722-jcv5-w7mc
Mar 26, 2026
NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33218
GO-2026-4837
BIT-nats-2026-33218
GHSA-vprv-35vv-q339
Mar 26, 2026
NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-27889
GO-2026-4841
BIT-nats-2026-27889
GHSA-pq2q-rcw4-3hr6
Mar 26, 2026
NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33223
GO-2026-4835
BIT-nats-2026-33223
GHSA-pwx7-fx9r-hr4h
Mar 26, 2026
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33246
GO-2026-4830
BIT-nats-2026-33246
GHSA-55h8-8g96-x4hj
Mar 26, 2026
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33219
GO-2026-4831
BIT-nats-2026-33219
GHSA-8r68-gvr4-jh7j
Mar 26, 2026
NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33247
GO-2026-4827
BIT-nats-2026-33247
GHSA-x6g4-f6q3-fqvv
Mar 26, 2026
NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33248
GO-2026-4828
BIT-nats-2026-33248
GHSA-3f24-pcvm-5jqc
Mar 26, 2026
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33249
GO-2026-4826
BIT-nats-2026-33249
GHSA-8m2x-3m6q-6w8j
Mar 26, 2026
NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 30, 2026 · Source: OSV.dev
CVE-2026-27571
GO-2026-4533
BIT-nats-2026-27571
GHSA-qrvq-68c2-7grw
Feb 25, 2026
nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server Fixed in
2.11.12
2.12.3
References Updated Mar 02, 2026 · Source: OSV.dev |
v2.12.1-RC.3
pre
Dependencies (12)
+ 4 more |
|
v2.12.0-RC.6
pre
12 CVEs
CVE-2026-33217
GO-2026-4834
BIT-nats-2026-33217
GHSA-jxxm-27vp-c3m5
Mar 26, 2026
NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33215
GO-2026-4833
BIT-nats-2026-33215
GHSA-fcjp-h8cc-6879
Mar 26, 2026
NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33222
GO-2026-4832
BIT-nats-2026-33222
GHSA-9983-vrx2-fg9c
Mar 26, 2026
NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-29785
GO-2026-4829
BIT-nats-2026-29785
GHSA-52jh-2xxh-pwh6
Mar 26, 2026
NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 31, 2026 · Source: OSV.dev
CVE-2026-33216
GO-2026-4836
BIT-nats-2026-33216
GHSA-v722-jcv5-w7mc
Mar 26, 2026
NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33218
GO-2026-4837
BIT-nats-2026-33218
GHSA-vprv-35vv-q339
Mar 26, 2026
NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33223
GO-2026-4835
BIT-nats-2026-33223
GHSA-pwx7-fx9r-hr4h
Mar 26, 2026
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33246
GO-2026-4830
BIT-nats-2026-33246
GHSA-55h8-8g96-x4hj
Mar 26, 2026
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33219
GO-2026-4831
BIT-nats-2026-33219
GHSA-8r68-gvr4-jh7j
Mar 26, 2026
NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33247
GO-2026-4827
BIT-nats-2026-33247
GHSA-x6g4-f6q3-fqvv
Mar 26, 2026
NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33248
GO-2026-4828
BIT-nats-2026-33248
GHSA-3f24-pcvm-5jqc
Mar 26, 2026
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-27571
GO-2026-4533
BIT-nats-2026-27571
GHSA-qrvq-68c2-7grw
Feb 25, 2026
nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server Fixed in
2.11.12
2.12.3
References Updated Mar 02, 2026 · Source: OSV.dev |
v2.12.0-RC.6
pre
Dependencies (12)
+ 4 more |
|
v2.12.0-RC.1
pre
12 CVEs
CVE-2026-33217
GO-2026-4834
BIT-nats-2026-33217
GHSA-jxxm-27vp-c3m5
Mar 26, 2026
NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33215
GO-2026-4833
BIT-nats-2026-33215
GHSA-fcjp-h8cc-6879
Mar 26, 2026
NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33222
GO-2026-4832
BIT-nats-2026-33222
GHSA-9983-vrx2-fg9c
Mar 26, 2026
NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-29785
GO-2026-4829
BIT-nats-2026-29785
GHSA-52jh-2xxh-pwh6
Mar 26, 2026
NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 31, 2026 · Source: OSV.dev
CVE-2026-33216
GO-2026-4836
BIT-nats-2026-33216
GHSA-v722-jcv5-w7mc
Mar 26, 2026
NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33218
GO-2026-4837
BIT-nats-2026-33218
GHSA-vprv-35vv-q339
Mar 26, 2026
NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33223
GO-2026-4835
BIT-nats-2026-33223
GHSA-pwx7-fx9r-hr4h
Mar 26, 2026
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33246
GO-2026-4830
BIT-nats-2026-33246
GHSA-55h8-8g96-x4hj
Mar 26, 2026
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33219
GO-2026-4831
BIT-nats-2026-33219
GHSA-8r68-gvr4-jh7j
Mar 26, 2026
NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33247
GO-2026-4827
BIT-nats-2026-33247
GHSA-x6g4-f6q3-fqvv
Mar 26, 2026
NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33248
GO-2026-4828
BIT-nats-2026-33248
GHSA-3f24-pcvm-5jqc
Mar 26, 2026
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-27571
GO-2026-4533
BIT-nats-2026-27571
GHSA-qrvq-68c2-7grw
Feb 25, 2026
nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server Fixed in
2.11.12
2.12.3
References Updated Mar 02, 2026 · Source: OSV.dev |
v2.12.0-RC.1
pre
Dependencies (12)
+ 4 more |
|
v2.11.9-RC.3
pre
14 CVEs
CVE-2026-33217
GO-2026-4834
BIT-nats-2026-33217
GHSA-jxxm-27vp-c3m5
Mar 26, 2026
NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33215
GO-2026-4833
BIT-nats-2026-33215
GHSA-fcjp-h8cc-6879
Mar 26, 2026
NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33222
GO-2026-4832
BIT-nats-2026-33222
GHSA-9983-vrx2-fg9c
Mar 26, 2026
NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-29785
GO-2026-4829
BIT-nats-2026-29785
GHSA-52jh-2xxh-pwh6
Mar 26, 2026
NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 31, 2026 · Source: OSV.dev
CVE-2026-33216
GO-2026-4836
BIT-nats-2026-33216
GHSA-v722-jcv5-w7mc
Mar 26, 2026
NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33218
GO-2026-4837
BIT-nats-2026-33218
GHSA-vprv-35vv-q339
Mar 26, 2026
NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-27889
GO-2026-4841
BIT-nats-2026-27889
GHSA-pq2q-rcw4-3hr6
Mar 26, 2026
NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33223
GO-2026-4835
BIT-nats-2026-33223
GHSA-pwx7-fx9r-hr4h
Mar 26, 2026
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33246
GO-2026-4830
BIT-nats-2026-33246
GHSA-55h8-8g96-x4hj
Mar 26, 2026
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33219
GO-2026-4831
BIT-nats-2026-33219
GHSA-8r68-gvr4-jh7j
Mar 26, 2026
NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33247
GO-2026-4827
BIT-nats-2026-33247
GHSA-x6g4-f6q3-fqvv
Mar 26, 2026
NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33248
GO-2026-4828
BIT-nats-2026-33248
GHSA-3f24-pcvm-5jqc
Mar 26, 2026
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33249
GO-2026-4826
BIT-nats-2026-33249
GHSA-8m2x-3m6q-6w8j
Mar 26, 2026
NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 30, 2026 · Source: OSV.dev
CVE-2026-27571
GO-2026-4533
BIT-nats-2026-27571
GHSA-qrvq-68c2-7grw
Feb 25, 2026
nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server Fixed in
2.11.12
2.12.3
References Updated Mar 02, 2026 · Source: OSV.dev |
v2.11.9-RC.3
pre
Dependencies (12)
+ 4 more |
|
v2.12.0-preview.2
pre
13 CVEs
CVE-2026-33217
GO-2026-4834
BIT-nats-2026-33217
GHSA-jxxm-27vp-c3m5
Mar 26, 2026
NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33215
GO-2026-4833
BIT-nats-2026-33215
GHSA-fcjp-h8cc-6879
Mar 26, 2026
NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33222
GO-2026-4832
BIT-nats-2026-33222
GHSA-9983-vrx2-fg9c
Mar 26, 2026
NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-29785
GO-2026-4829
BIT-nats-2026-29785
GHSA-52jh-2xxh-pwh6
Mar 26, 2026
NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 31, 2026 · Source: OSV.dev
CVE-2026-33216
GO-2026-4836
BIT-nats-2026-33216
GHSA-v722-jcv5-w7mc
Mar 26, 2026
NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33218
GO-2026-4837
BIT-nats-2026-33218
GHSA-vprv-35vv-q339
Mar 26, 2026
NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33223
GO-2026-4835
BIT-nats-2026-33223
GHSA-pwx7-fx9r-hr4h
Mar 26, 2026
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33246
GO-2026-4830
BIT-nats-2026-33246
GHSA-55h8-8g96-x4hj
Mar 26, 2026
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33219
GO-2026-4831
BIT-nats-2026-33219
GHSA-8r68-gvr4-jh7j
Mar 26, 2026
NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33247
GO-2026-4827
BIT-nats-2026-33247
GHSA-x6g4-f6q3-fqvv
Mar 26, 2026
NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33248
GO-2026-4828
BIT-nats-2026-33248
GHSA-3f24-pcvm-5jqc
Mar 26, 2026
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33249
GO-2026-4826
BIT-nats-2026-33249
GHSA-8m2x-3m6q-6w8j
Mar 26, 2026
NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 30, 2026 · Source: OSV.dev
CVE-2026-27571
GO-2026-4533
BIT-nats-2026-27571
GHSA-qrvq-68c2-7grw
Feb 25, 2026
nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server Fixed in
2.11.12
2.12.3
References Updated Mar 02, 2026 · Source: OSV.dev |
v2.12.0-preview.2
pre
Dependencies (12)
+ 4 more |
|
v2.11.9-RC.2
pre
14 CVEs
CVE-2026-33217
GO-2026-4834
BIT-nats-2026-33217
GHSA-jxxm-27vp-c3m5
Mar 26, 2026
NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33215
GO-2026-4833
BIT-nats-2026-33215
GHSA-fcjp-h8cc-6879
Mar 26, 2026
NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33222
GO-2026-4832
BIT-nats-2026-33222
GHSA-9983-vrx2-fg9c
Mar 26, 2026
NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-29785
GO-2026-4829
BIT-nats-2026-29785
GHSA-52jh-2xxh-pwh6
Mar 26, 2026
NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 31, 2026 · Source: OSV.dev
CVE-2026-33216
GO-2026-4836
BIT-nats-2026-33216
GHSA-v722-jcv5-w7mc
Mar 26, 2026
NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33218
GO-2026-4837
BIT-nats-2026-33218
GHSA-vprv-35vv-q339
Mar 26, 2026
NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-27889
GO-2026-4841
BIT-nats-2026-27889
GHSA-pq2q-rcw4-3hr6
Mar 26, 2026
NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33223
GO-2026-4835
BIT-nats-2026-33223
GHSA-pwx7-fx9r-hr4h
Mar 26, 2026
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33246
GO-2026-4830
BIT-nats-2026-33246
GHSA-55h8-8g96-x4hj
Mar 26, 2026
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33219
GO-2026-4831
BIT-nats-2026-33219
GHSA-8r68-gvr4-jh7j
Mar 26, 2026
NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33247
GO-2026-4827
BIT-nats-2026-33247
GHSA-x6g4-f6q3-fqvv
Mar 26, 2026
NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33248
GO-2026-4828
BIT-nats-2026-33248
GHSA-3f24-pcvm-5jqc
Mar 26, 2026
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33249
GO-2026-4826
BIT-nats-2026-33249
GHSA-8m2x-3m6q-6w8j
Mar 26, 2026
NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 30, 2026 · Source: OSV.dev
CVE-2026-27571
GO-2026-4533
BIT-nats-2026-27571
GHSA-qrvq-68c2-7grw
Feb 25, 2026
nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server Fixed in
2.11.12
2.12.3
References Updated Mar 02, 2026 · Source: OSV.dev |
v2.11.9-RC.2
pre
Dependencies (12)
+ 4 more |
|
v2.11.8
patch
14 CVEs
CVE-2026-33217
GO-2026-4834
BIT-nats-2026-33217
GHSA-jxxm-27vp-c3m5
Mar 26, 2026
NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33215
GO-2026-4833
BIT-nats-2026-33215
GHSA-fcjp-h8cc-6879
Mar 26, 2026
NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33222
GO-2026-4832
BIT-nats-2026-33222
GHSA-9983-vrx2-fg9c
Mar 26, 2026
NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-29785
GO-2026-4829
BIT-nats-2026-29785
GHSA-52jh-2xxh-pwh6
Mar 26, 2026
NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 31, 2026 · Source: OSV.dev
CVE-2026-33216
GO-2026-4836
BIT-nats-2026-33216
GHSA-v722-jcv5-w7mc
Mar 26, 2026
NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33218
GO-2026-4837
BIT-nats-2026-33218
GHSA-vprv-35vv-q339
Mar 26, 2026
NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-27889
GO-2026-4841
BIT-nats-2026-27889
GHSA-pq2q-rcw4-3hr6
Mar 26, 2026
NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33223
GO-2026-4835
BIT-nats-2026-33223
GHSA-pwx7-fx9r-hr4h
Mar 26, 2026
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33246
GO-2026-4830
BIT-nats-2026-33246
GHSA-55h8-8g96-x4hj
Mar 26, 2026
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33219
GO-2026-4831
BIT-nats-2026-33219
GHSA-8r68-gvr4-jh7j
Mar 26, 2026
NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33247
GO-2026-4827
BIT-nats-2026-33247
GHSA-x6g4-f6q3-fqvv
Mar 26, 2026
NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33248
GO-2026-4828
BIT-nats-2026-33248
GHSA-3f24-pcvm-5jqc
Mar 26, 2026
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33249
GO-2026-4826
BIT-nats-2026-33249
GHSA-8m2x-3m6q-6w8j
Mar 26, 2026
NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 30, 2026 · Source: OSV.dev
CVE-2026-27571
GO-2026-4533
BIT-nats-2026-27571
GHSA-qrvq-68c2-7grw
Feb 25, 2026
nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server Fixed in
2.11.12
2.12.3
References Updated Mar 02, 2026 · Source: OSV.dev |
v2.11.8
patch
Dependencies (12)
+ 4 more |
|
v2.12.0-preview.1
pre
13 CVEs
CVE-2026-33217
GO-2026-4834
BIT-nats-2026-33217
GHSA-jxxm-27vp-c3m5
Mar 26, 2026
NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33215
GO-2026-4833
BIT-nats-2026-33215
GHSA-fcjp-h8cc-6879
Mar 26, 2026
NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33222
GO-2026-4832
BIT-nats-2026-33222
GHSA-9983-vrx2-fg9c
Mar 26, 2026
NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-29785
GO-2026-4829
BIT-nats-2026-29785
GHSA-52jh-2xxh-pwh6
Mar 26, 2026
NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 31, 2026 · Source: OSV.dev
CVE-2026-33216
GO-2026-4836
BIT-nats-2026-33216
GHSA-v722-jcv5-w7mc
Mar 26, 2026
NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33218
GO-2026-4837
BIT-nats-2026-33218
GHSA-vprv-35vv-q339
Mar 26, 2026
NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33223
GO-2026-4835
BIT-nats-2026-33223
GHSA-pwx7-fx9r-hr4h
Mar 26, 2026
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33246
GO-2026-4830
BIT-nats-2026-33246
GHSA-55h8-8g96-x4hj
Mar 26, 2026
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33219
GO-2026-4831
BIT-nats-2026-33219
GHSA-8r68-gvr4-jh7j
Mar 26, 2026
NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33247
GO-2026-4827
BIT-nats-2026-33247
GHSA-x6g4-f6q3-fqvv
Mar 26, 2026
NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33248
GO-2026-4828
BIT-nats-2026-33248
GHSA-3f24-pcvm-5jqc
Mar 26, 2026
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33249
GO-2026-4826
BIT-nats-2026-33249
GHSA-8m2x-3m6q-6w8j
Mar 26, 2026
NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 30, 2026 · Source: OSV.dev
CVE-2026-27571
GO-2026-4533
BIT-nats-2026-27571
GHSA-qrvq-68c2-7grw
Feb 25, 2026
nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server Fixed in
2.11.12
2.12.3
References Updated Mar 02, 2026 · Source: OSV.dev |
v2.12.0-preview.1
pre
Dependencies (12)
+ 4 more |
|
v2.11.4-RC.3
pre
14 CVEs
CVE-2026-33217
GO-2026-4834
BIT-nats-2026-33217
GHSA-jxxm-27vp-c3m5
Mar 26, 2026
NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33215
GO-2026-4833
BIT-nats-2026-33215
GHSA-fcjp-h8cc-6879
Mar 26, 2026
NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33222
GO-2026-4832
BIT-nats-2026-33222
GHSA-9983-vrx2-fg9c
Mar 26, 2026
NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-29785
GO-2026-4829
BIT-nats-2026-29785
GHSA-52jh-2xxh-pwh6
Mar 26, 2026
NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 31, 2026 · Source: OSV.dev
CVE-2026-33216
GO-2026-4836
BIT-nats-2026-33216
GHSA-v722-jcv5-w7mc
Mar 26, 2026
NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33218
GO-2026-4837
BIT-nats-2026-33218
GHSA-vprv-35vv-q339
Mar 26, 2026
NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-27889
GO-2026-4841
BIT-nats-2026-27889
GHSA-pq2q-rcw4-3hr6
Mar 26, 2026
NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33223
GO-2026-4835
BIT-nats-2026-33223
GHSA-pwx7-fx9r-hr4h
Mar 26, 2026
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33246
GO-2026-4830
BIT-nats-2026-33246
GHSA-55h8-8g96-x4hj
Mar 26, 2026
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33219
GO-2026-4831
BIT-nats-2026-33219
GHSA-8r68-gvr4-jh7j
Mar 26, 2026
NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33247
GO-2026-4827
BIT-nats-2026-33247
GHSA-x6g4-f6q3-fqvv
Mar 26, 2026
NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33248
GO-2026-4828
BIT-nats-2026-33248
GHSA-3f24-pcvm-5jqc
Mar 26, 2026
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33249
GO-2026-4826
BIT-nats-2026-33249
GHSA-8m2x-3m6q-6w8j
Mar 26, 2026
NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 30, 2026 · Source: OSV.dev
CVE-2026-27571
GO-2026-4533
BIT-nats-2026-27571
GHSA-qrvq-68c2-7grw
Feb 25, 2026
nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server Fixed in
2.11.12
2.12.3
References Updated Mar 02, 2026 · Source: OSV.dev |
v2.11.4-RC.3
pre
Dependencies (12)
+ 4 more |
|
v2.11.4-RC.1
pre
14 CVEs
CVE-2026-33217
GO-2026-4834
BIT-nats-2026-33217
GHSA-jxxm-27vp-c3m5
Mar 26, 2026
NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33215
GO-2026-4833
BIT-nats-2026-33215
GHSA-fcjp-h8cc-6879
Mar 26, 2026
NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33222
GO-2026-4832
BIT-nats-2026-33222
GHSA-9983-vrx2-fg9c
Mar 26, 2026
NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-29785
GO-2026-4829
BIT-nats-2026-29785
GHSA-52jh-2xxh-pwh6
Mar 26, 2026
NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 31, 2026 · Source: OSV.dev
CVE-2026-33216
GO-2026-4836
BIT-nats-2026-33216
GHSA-v722-jcv5-w7mc
Mar 26, 2026
NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33218
GO-2026-4837
BIT-nats-2026-33218
GHSA-vprv-35vv-q339
Mar 26, 2026
NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-27889
GO-2026-4841
BIT-nats-2026-27889
GHSA-pq2q-rcw4-3hr6
Mar 26, 2026
NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33223
GO-2026-4835
BIT-nats-2026-33223
GHSA-pwx7-fx9r-hr4h
Mar 26, 2026
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33246
GO-2026-4830
BIT-nats-2026-33246
GHSA-55h8-8g96-x4hj
Mar 26, 2026
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33219
GO-2026-4831
BIT-nats-2026-33219
GHSA-8r68-gvr4-jh7j
Mar 26, 2026
NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33247
GO-2026-4827
BIT-nats-2026-33247
GHSA-x6g4-f6q3-fqvv
Mar 26, 2026
NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33248
GO-2026-4828
BIT-nats-2026-33248
GHSA-3f24-pcvm-5jqc
Mar 26, 2026
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33249
GO-2026-4826
BIT-nats-2026-33249
GHSA-8m2x-3m6q-6w8j
Mar 26, 2026
NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 30, 2026 · Source: OSV.dev
CVE-2026-27571
GO-2026-4533
BIT-nats-2026-27571
GHSA-qrvq-68c2-7grw
Feb 25, 2026
nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server Fixed in
2.11.12
2.12.3
References Updated Mar 02, 2026 · Source: OSV.dev |
v2.11.4-RC.1
pre
Dependencies (12)
+ 4 more |
|
v2.11.3
patch
14 CVEs
CVE-2026-33217
GO-2026-4834
BIT-nats-2026-33217
GHSA-jxxm-27vp-c3m5
Mar 26, 2026
NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33215
GO-2026-4833
BIT-nats-2026-33215
GHSA-fcjp-h8cc-6879
Mar 26, 2026
NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33222
GO-2026-4832
BIT-nats-2026-33222
GHSA-9983-vrx2-fg9c
Mar 26, 2026
NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-29785
GO-2026-4829
BIT-nats-2026-29785
GHSA-52jh-2xxh-pwh6
Mar 26, 2026
NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 31, 2026 · Source: OSV.dev
CVE-2026-33216
GO-2026-4836
BIT-nats-2026-33216
GHSA-v722-jcv5-w7mc
Mar 26, 2026
NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33218
GO-2026-4837
BIT-nats-2026-33218
GHSA-vprv-35vv-q339
Mar 26, 2026
NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-27889
GO-2026-4841
BIT-nats-2026-27889
GHSA-pq2q-rcw4-3hr6
Mar 26, 2026
NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33223
GO-2026-4835
BIT-nats-2026-33223
GHSA-pwx7-fx9r-hr4h
Mar 26, 2026
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33246
GO-2026-4830
BIT-nats-2026-33246
GHSA-55h8-8g96-x4hj
Mar 26, 2026
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33219
GO-2026-4831
BIT-nats-2026-33219
GHSA-8r68-gvr4-jh7j
Mar 26, 2026
NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33247
GO-2026-4827
BIT-nats-2026-33247
GHSA-x6g4-f6q3-fqvv
Mar 26, 2026
NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33248
GO-2026-4828
BIT-nats-2026-33248
GHSA-3f24-pcvm-5jqc
Mar 26, 2026
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33249
GO-2026-4826
BIT-nats-2026-33249
GHSA-8m2x-3m6q-6w8j
Mar 26, 2026
NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 30, 2026 · Source: OSV.dev
CVE-2026-27571
GO-2026-4533
BIT-nats-2026-27571
GHSA-qrvq-68c2-7grw
Feb 25, 2026
nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server Fixed in
2.11.12
2.12.3
References Updated Mar 02, 2026 · Source: OSV.dev |
v2.11.3
patch
Dependencies (12)
+ 4 more |
|
v2.11.3-RC.2
pre
14 CVEs
CVE-2026-33217
GO-2026-4834
BIT-nats-2026-33217
GHSA-jxxm-27vp-c3m5
Mar 26, 2026
NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33215
GO-2026-4833
BIT-nats-2026-33215
GHSA-fcjp-h8cc-6879
Mar 26, 2026
NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33222
GO-2026-4832
BIT-nats-2026-33222
GHSA-9983-vrx2-fg9c
Mar 26, 2026
NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-29785
GO-2026-4829
BIT-nats-2026-29785
GHSA-52jh-2xxh-pwh6
Mar 26, 2026
NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 31, 2026 · Source: OSV.dev
CVE-2026-33216
GO-2026-4836
BIT-nats-2026-33216
GHSA-v722-jcv5-w7mc
Mar 26, 2026
NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33218
GO-2026-4837
BIT-nats-2026-33218
GHSA-vprv-35vv-q339
Mar 26, 2026
NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-27889
GO-2026-4841
BIT-nats-2026-27889
GHSA-pq2q-rcw4-3hr6
Mar 26, 2026
NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33223
GO-2026-4835
BIT-nats-2026-33223
GHSA-pwx7-fx9r-hr4h
Mar 26, 2026
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33246
GO-2026-4830
BIT-nats-2026-33246
GHSA-55h8-8g96-x4hj
Mar 26, 2026
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33219
GO-2026-4831
BIT-nats-2026-33219
GHSA-8r68-gvr4-jh7j
Mar 26, 2026
NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33247
GO-2026-4827
BIT-nats-2026-33247
GHSA-x6g4-f6q3-fqvv
Mar 26, 2026
NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33248
GO-2026-4828
BIT-nats-2026-33248
GHSA-3f24-pcvm-5jqc
Mar 26, 2026
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33249
GO-2026-4826
BIT-nats-2026-33249
GHSA-8m2x-3m6q-6w8j
Mar 26, 2026
NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 30, 2026 · Source: OSV.dev
CVE-2026-27571
GO-2026-4533
BIT-nats-2026-27571
GHSA-qrvq-68c2-7grw
Feb 25, 2026
nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server Fixed in
2.11.12
2.12.3
References Updated Mar 02, 2026 · Source: OSV.dev |
v2.11.3-RC.2
pre
Dependencies (12)
+ 4 more |
|
v2.11.2
patch
14 CVEs
CVE-2026-33217
GO-2026-4834
BIT-nats-2026-33217
GHSA-jxxm-27vp-c3m5
Mar 26, 2026
NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33215
GO-2026-4833
BIT-nats-2026-33215
GHSA-fcjp-h8cc-6879
Mar 26, 2026
NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33222
GO-2026-4832
BIT-nats-2026-33222
GHSA-9983-vrx2-fg9c
Mar 26, 2026
NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-29785
GO-2026-4829
BIT-nats-2026-29785
GHSA-52jh-2xxh-pwh6
Mar 26, 2026
NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 31, 2026 · Source: OSV.dev
CVE-2026-33216
GO-2026-4836
BIT-nats-2026-33216
GHSA-v722-jcv5-w7mc
Mar 26, 2026
NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33218
GO-2026-4837
BIT-nats-2026-33218
GHSA-vprv-35vv-q339
Mar 26, 2026
NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-27889
GO-2026-4841
BIT-nats-2026-27889
GHSA-pq2q-rcw4-3hr6
Mar 26, 2026
NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33223
GO-2026-4835
BIT-nats-2026-33223
GHSA-pwx7-fx9r-hr4h
Mar 26, 2026
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33246
GO-2026-4830
BIT-nats-2026-33246
GHSA-55h8-8g96-x4hj
Mar 26, 2026
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33219
GO-2026-4831
BIT-nats-2026-33219
GHSA-8r68-gvr4-jh7j
Mar 26, 2026
NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33247
GO-2026-4827
BIT-nats-2026-33247
GHSA-x6g4-f6q3-fqvv
Mar 26, 2026
NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33248
GO-2026-4828
BIT-nats-2026-33248
GHSA-3f24-pcvm-5jqc
Mar 26, 2026
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33249
GO-2026-4826
BIT-nats-2026-33249
GHSA-8m2x-3m6q-6w8j
Mar 26, 2026
NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 30, 2026 · Source: OSV.dev
CVE-2026-27571
GO-2026-4533
BIT-nats-2026-27571
GHSA-qrvq-68c2-7grw
Feb 25, 2026
nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server Fixed in
2.11.12
2.12.3
References Updated Mar 02, 2026 · Source: OSV.dev |
v2.11.2
patch
Dependencies (12)
+ 4 more |
|
v2.10.28
patch
13 CVEs
CVE-2026-33217
GO-2026-4834
BIT-nats-2026-33217
GHSA-jxxm-27vp-c3m5
Mar 26, 2026
NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33215
GO-2026-4833
BIT-nats-2026-33215
GHSA-fcjp-h8cc-6879
Mar 26, 2026
NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33222
GO-2026-4832
BIT-nats-2026-33222
GHSA-9983-vrx2-fg9c
Mar 26, 2026
NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-29785
GO-2026-4829
BIT-nats-2026-29785
GHSA-52jh-2xxh-pwh6
Mar 26, 2026
NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 31, 2026 · Source: OSV.dev
CVE-2026-33216
GO-2026-4836
BIT-nats-2026-33216
GHSA-v722-jcv5-w7mc
Mar 26, 2026
NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33218
GO-2026-4837
BIT-nats-2026-33218
GHSA-vprv-35vv-q339
Mar 26, 2026
NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-27889
GO-2026-4841
BIT-nats-2026-27889
GHSA-pq2q-rcw4-3hr6
Mar 26, 2026
NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33223
GO-2026-4835
BIT-nats-2026-33223
GHSA-pwx7-fx9r-hr4h
Mar 26, 2026
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33246
GO-2026-4830
BIT-nats-2026-33246
GHSA-55h8-8g96-x4hj
Mar 26, 2026
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33219
GO-2026-4831
BIT-nats-2026-33219
GHSA-8r68-gvr4-jh7j
Mar 26, 2026
NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33247
GO-2026-4827
BIT-nats-2026-33247
GHSA-x6g4-f6q3-fqvv
Mar 26, 2026
NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33248
GO-2026-4828
BIT-nats-2026-33248
GHSA-3f24-pcvm-5jqc
Mar 26, 2026
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-27571
GO-2026-4533
BIT-nats-2026-27571
GHSA-qrvq-68c2-7grw
Feb 25, 2026
nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server Fixed in
2.11.12
2.12.3
References Updated Mar 02, 2026 · Source: OSV.dev |
v2.10.28
patch
Dependencies (10)
+ 2 more |
|
v2.11.2-RC.3
pre
14 CVEs
CVE-2026-33217
GO-2026-4834
BIT-nats-2026-33217
GHSA-jxxm-27vp-c3m5
Mar 26, 2026
NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33215
GO-2026-4833
BIT-nats-2026-33215
GHSA-fcjp-h8cc-6879
Mar 26, 2026
NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33222
GO-2026-4832
BIT-nats-2026-33222
GHSA-9983-vrx2-fg9c
Mar 26, 2026
NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-29785
GO-2026-4829
BIT-nats-2026-29785
GHSA-52jh-2xxh-pwh6
Mar 26, 2026
NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 31, 2026 · Source: OSV.dev
CVE-2026-33216
GO-2026-4836
BIT-nats-2026-33216
GHSA-v722-jcv5-w7mc
Mar 26, 2026
NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33218
GO-2026-4837
BIT-nats-2026-33218
GHSA-vprv-35vv-q339
Mar 26, 2026
NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-27889
GO-2026-4841
BIT-nats-2026-27889
GHSA-pq2q-rcw4-3hr6
Mar 26, 2026
NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33223
GO-2026-4835
BIT-nats-2026-33223
GHSA-pwx7-fx9r-hr4h
Mar 26, 2026
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33246
GO-2026-4830
BIT-nats-2026-33246
GHSA-55h8-8g96-x4hj
Mar 26, 2026
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33219
GO-2026-4831
BIT-nats-2026-33219
GHSA-8r68-gvr4-jh7j
Mar 26, 2026
NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33247
GO-2026-4827
BIT-nats-2026-33247
GHSA-x6g4-f6q3-fqvv
Mar 26, 2026
NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33248
GO-2026-4828
BIT-nats-2026-33248
GHSA-3f24-pcvm-5jqc
Mar 26, 2026
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33249
GO-2026-4826
BIT-nats-2026-33249
GHSA-8m2x-3m6q-6w8j
Mar 26, 2026
NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 30, 2026 · Source: OSV.dev
CVE-2026-27571
GO-2026-4533
BIT-nats-2026-27571
GHSA-qrvq-68c2-7grw
Feb 25, 2026
nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server Fixed in
2.11.12
2.12.3
References Updated Mar 02, 2026 · Source: OSV.dev |
v2.11.2-RC.3
pre
Dependencies (12)
+ 4 more |
|
v2.11.1
minor
14 CVEs
CVE-2026-33217
GO-2026-4834
BIT-nats-2026-33217
GHSA-jxxm-27vp-c3m5
Mar 26, 2026
NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33215
GO-2026-4833
BIT-nats-2026-33215
GHSA-fcjp-h8cc-6879
Mar 26, 2026
NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33222
GO-2026-4832
BIT-nats-2026-33222
GHSA-9983-vrx2-fg9c
Mar 26, 2026
NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-29785
GO-2026-4829
BIT-nats-2026-29785
GHSA-52jh-2xxh-pwh6
Mar 26, 2026
NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 31, 2026 · Source: OSV.dev
CVE-2026-33216
GO-2026-4836
BIT-nats-2026-33216
GHSA-v722-jcv5-w7mc
Mar 26, 2026
NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33218
GO-2026-4837
BIT-nats-2026-33218
GHSA-vprv-35vv-q339
Mar 26, 2026
NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-27889
GO-2026-4841
BIT-nats-2026-27889
GHSA-pq2q-rcw4-3hr6
Mar 26, 2026
NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33223
GO-2026-4835
BIT-nats-2026-33223
GHSA-pwx7-fx9r-hr4h
Mar 26, 2026
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33246
GO-2026-4830
BIT-nats-2026-33246
GHSA-55h8-8g96-x4hj
Mar 26, 2026
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33219
GO-2026-4831
BIT-nats-2026-33219
GHSA-8r68-gvr4-jh7j
Mar 26, 2026
NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33247
GO-2026-4827
BIT-nats-2026-33247
GHSA-x6g4-f6q3-fqvv
Mar 26, 2026
NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33248
GO-2026-4828
BIT-nats-2026-33248
GHSA-3f24-pcvm-5jqc
Mar 26, 2026
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33249
GO-2026-4826
BIT-nats-2026-33249
GHSA-8m2x-3m6q-6w8j
Mar 26, 2026
NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 30, 2026 · Source: OSV.dev
CVE-2026-27571
GO-2026-4533
BIT-nats-2026-27571
GHSA-qrvq-68c2-7grw
Feb 25, 2026
nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server Fixed in
2.11.12
2.12.3
References Updated Mar 02, 2026 · Source: OSV.dev |
v2.11.1
minor
Dependencies (12)
+ 4 more |
|
v2.11.0-RC.2
pre
13 CVEs
CVE-2026-33217
GO-2026-4834
BIT-nats-2026-33217
GHSA-jxxm-27vp-c3m5
Mar 26, 2026
NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33215
GO-2026-4833
BIT-nats-2026-33215
GHSA-fcjp-h8cc-6879
Mar 26, 2026
NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33222
GO-2026-4832
BIT-nats-2026-33222
GHSA-9983-vrx2-fg9c
Mar 26, 2026
NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-29785
GO-2026-4829
BIT-nats-2026-29785
GHSA-52jh-2xxh-pwh6
Mar 26, 2026
NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 31, 2026 · Source: OSV.dev
CVE-2026-33216
GO-2026-4836
BIT-nats-2026-33216
GHSA-v722-jcv5-w7mc
Mar 26, 2026
NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33218
GO-2026-4837
BIT-nats-2026-33218
GHSA-vprv-35vv-q339
Mar 26, 2026
NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-27889
GO-2026-4841
BIT-nats-2026-27889
GHSA-pq2q-rcw4-3hr6
Mar 26, 2026
NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33223
GO-2026-4835
BIT-nats-2026-33223
GHSA-pwx7-fx9r-hr4h
Mar 26, 2026
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33246
GO-2026-4830
BIT-nats-2026-33246
GHSA-55h8-8g96-x4hj
Mar 26, 2026
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33219
GO-2026-4831
BIT-nats-2026-33219
GHSA-8r68-gvr4-jh7j
Mar 26, 2026
NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33247
GO-2026-4827
BIT-nats-2026-33247
GHSA-x6g4-f6q3-fqvv
Mar 26, 2026
NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33248
GO-2026-4828
BIT-nats-2026-33248
GHSA-3f24-pcvm-5jqc
Mar 26, 2026
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-27571
GO-2026-4533
BIT-nats-2026-27571
GHSA-qrvq-68c2-7grw
Feb 25, 2026
nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server Fixed in
2.11.12
2.12.3
References Updated Mar 02, 2026 · Source: OSV.dev |
v2.11.0-RC.2
pre
Dependencies (12)
+ 4 more |
|
v2.10.25-RC.3
pre
14 CVEs
CVE-2026-33217
GO-2026-4834
BIT-nats-2026-33217
GHSA-jxxm-27vp-c3m5
Mar 26, 2026
NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33215
GO-2026-4833
BIT-nats-2026-33215
GHSA-fcjp-h8cc-6879
Mar 26, 2026
NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33222
GO-2026-4832
BIT-nats-2026-33222
GHSA-9983-vrx2-fg9c
Mar 26, 2026
NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-29785
GO-2026-4829
BIT-nats-2026-29785
GHSA-52jh-2xxh-pwh6
Mar 26, 2026
NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 31, 2026 · Source: OSV.dev
CVE-2026-33216
GO-2026-4836
BIT-nats-2026-33216
GHSA-v722-jcv5-w7mc
Mar 26, 2026
NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33218
GO-2026-4837
BIT-nats-2026-33218
GHSA-vprv-35vv-q339
Mar 26, 2026
NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-27889
GO-2026-4841
BIT-nats-2026-27889
GHSA-pq2q-rcw4-3hr6
Mar 26, 2026
NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server Fixed in
2.11.14
2.12.5
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33223
GO-2026-4835
BIT-nats-2026-33223
GHSA-pwx7-fx9r-hr4h
Mar 26, 2026
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33246
GO-2026-4830
BIT-nats-2026-33246
GHSA-55h8-8g96-x4hj
Mar 26, 2026
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33219
GO-2026-4831
BIT-nats-2026-33219
GHSA-8r68-gvr4-jh7j
Mar 26, 2026
NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33247
GO-2026-4827
BIT-nats-2026-33247
GHSA-x6g4-f6q3-fqvv
Mar 26, 2026
NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-33248
GO-2026-4828
BIT-nats-2026-33248
GHSA-3f24-pcvm-5jqc
Mar 26, 2026
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server Fixed in
2.11.15
2.12.6
References Updated Mar 27, 2026 · Source: OSV.dev
CVE-2026-27571
GO-2026-4533
BIT-nats-2026-27571
GHSA-qrvq-68c2-7grw
Feb 25, 2026
nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server Fixed in
2.11.12
2.12.3
References Updated Mar 02, 2026 · Source: OSV.dev
CVE-2025-30215
GO-2025-3600
BIT-nats-2025-30215
GHSA-fhg8-qxh5-7q3w
Apr 22, 2025
Missing ACLs on JavaScript APIs allowing privilege escalation github.com/nats-io/nats-server Missing Fixed in
2.10.27
2.11.1
References Updated Feb 04, 2026 · Source: OSV.dev |
v2.10.25-RC.3
pre
Dependencies (10)
+ 2 more |