nats-io vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20251
3. 202626

Newest CVEs

• CVE-2026-58208

  NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled

  nats-io · nats-server

  Medium6.8
• CVE-2026-58211

  NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions

  nats-io · nats-server

  Medium5.4
• CVE-2026-58207

  NATS Server: Remote crash via integer overflow in Connz pagination

  nats-io · nats-server

  High7.7
• CVE-2026-58210

  NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory

  nats-io · nats-server

  High7.5
• CVE-2026-58209

  NATS Server: MQTT retained and QoS replay bypass subscribe deny filters

  nats-io · nats-server

  Medium4.3
• CVE-2026-58214

  NATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217)

  nats-io · nats-server

  Medium4.3
• CVE-2026-58254

  NATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission check

  nats-io · nats-server

  Medium5.3
• CVE-2026-58213

  NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection

  nats-io · nats-server

  High7.1
• CVE-2026-58250

  NATS Server: Pre-auth server crash via double INFO in leafnode handshake

  nats-io · nats-server

  High7.5
• CVE-2026-58252

  NATS Server: Subscribe Authz Bypass via Wildcard-Overlap

  nats-io · nats-server

  Medium6.5