Linux / Nats-Server
36 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-58208 | NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled | HIGH | 7.5 | Jul 8, 2026 |
| CVE-2026-58211 | NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions | MEDIUM | 6.5 | Jul 8, 2026 |
| CVE-2026-58207 | NATS Server: Remote crash via integer overflow in Connz pagination | HIGH | 7.7 | Jul 8, 2026 |
| CVE-2026-58210 | NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory | HIGH | 7.5 | Jul 8, 2026 |
| CVE-2026-58209 | NATS Server: MQTT retained and QoS replay bypass subscribe deny filters | MEDIUM | 4.3 | Jul 8, 2026 |
| CVE-2026-58214 | NATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217) | MEDIUM | 4.3 | Jul 8, 2026 |
| CVE-2026-58254 | NATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission check | MEDIUM | 5.3 | Jul 8, 2026 |
| CVE-2026-58213 | NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection | HIGH | 7.1 | Jul 8, 2026 |
| CVE-2026-58250 | NATS Server: Pre-auth server crash via double INFO in leafnode handshake | HIGH | 7.5 | Jul 8, 2026 |
| CVE-2026-58252 | NATS Server: Subscribe Authz Bypass via Wildcard-Overlap | MEDIUM | 6.5 | Jul 8, 2026 |
| CVE-2026-58253 | NATS Server: Route API Auth Bypass | HIGH | 8.8 | Jul 8, 2026 |
| CVE-2026-58251 | NATS Server: Queue Subscribe Authz Bypass | MEDIUM | 6.5 | Jul 8, 2026 |
| CVE-2026-33249 | NATS: Message tracing can be redirected to arbitrary subject | MEDIUM | 6.4 | Mar 25, 2026 |
| CVE-2026-33223 | NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing | MEDIUM | 6.4 | Mar 25, 2026 |
| CVE-2026-33248 | NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching | MEDIUM | 4.8 | Mar 25, 2026 |
| CVE-2026-33222 | NATS JetStream has an authorization bypass through its Management API | MEDIUM | 4.9 | Mar 25, 2026 |
| CVE-2026-33247 | NATS credentials are exposed in monitoring port via command-line argv | HIGH | 7.5 | Mar 25, 2026 |
| CVE-2026-33219 | NATS is vulnerable to pre-auth DoS through WebSockets client service | HIGH | 7.5 | Mar 25, 2026 |
| CVE-2026-33218 | NATS has pre-auth server panic via leafnode handling | HIGH | 7.5 | Mar 25, 2026 |
| CVE-2026-33246 | NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers | MEDIUM | 6.4 | Mar 25, 2026 |
| CVE-2026-33217 | NATS allows MQTT clients to bypass ACL checks | HIGH | 8.1 | Mar 25, 2026 |
| CVE-2026-33216 | NATS has MQTT plaintext password disclosure | HIGH | 8.6 | Mar 25, 2026 |
| CVE-2026-29785 | NATS Server panic via malicious compression on leafnode port | HIGH | 7.5 | Mar 25, 2026 |
| CVE-2026-27889 | NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead | HIGH | 7.5 | Mar 25, 2026 |
| CVE-2026-33215 | NATS is vulnerable to MQTT hijacking via Client ID | MEDIUM | 6.5 | Mar 24, 2026 |
Showing 1 to 25 of 36 CVEs