Nats-server (Linuxfoundation) - vulnerabilities (CVEs)
36 CVEs, 0 in the last 30 days, 288 known versions, newest CVE from 2026-07-08. Vendor: Linuxfoundation.
CVEs of Nats-server
- CVE-2026-58208 - CVSS 7.5 (high), 2026-07-08: NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a WebSocket listener could…
- CVE-2026-58211 - CVSS 5.4 (medium), 2026-07-08: NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a client could be registered as…
- CVE-2026-58207 - CVSS 7.7 (high), 2026-07-08: NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a client able to send…
- CVE-2026-58210 - CVSS 7.5 (high), 2026-07-08: NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an unauthenticated MQTT client…
- CVE-2026-58209 - CVSS 4.3 (medium), 2026-07-08: NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery…
- CVE-2026-58214 - CVSS 4.3 (medium), 2026-07-08: NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an authenticated MQTT client…
- CVE-2026-58254 - CVSS 6.5 (medium), 2026-07-08: NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.8, message trace destination checks…
- CVE-2026-58213 - CVSS 7.1 (high), 2026-07-08: NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.1 and 2.12.9, an MQTT client could include…
- CVE-2026-58250 - CVSS 7.5 (high), 2026-07-08: NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.12.8 and 2.11.17, an unauthenticated peer with…
- CVE-2026-58252 - CVSS 6.5 (medium), 2026-07-08: NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user…
- CVE-2026-58253 - CVSS 8.8 (high), 2026-07-08: NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was…
- CVE-2026-58251 - CVSS 6.5 (medium), 2026-07-08: NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user…
- CVE-2026-33222 - CVSS 4.9 (medium), 2026-03-25: NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, users with JetStream…
- CVE-2026-33249 - CVSS 4.3 (medium), 2026-03-25: NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and…
- CVE-2026-33248 - CVSS 4.2 (medium), 2026-03-25: NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using mTLS for…
- CVE-2026-33223 - CVSS 6.4 (medium), 2026-03-25: NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, the NATS message header…
- CVE-2026-33247 - CVSS 7.5 (high), 2026-03-25: NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, if a nats-server is run…
- CVE-2026-33246 - CVSS 6.4 (medium), 2026-03-25: NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server offers a `Nats-Request-Info:` message header,…
- CVE-2026-33216 - CVSS 8.6 (high), 2026-03-25: NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments…
- CVE-2026-33219 - CVSS 7.5 (high), 2026-03-25: NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a malicious client which…
- CVE-2026-33218 - CVSS 7.5 (high), 2026-03-25: NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can…
- CVE-2026-33217 - CVSS 8.1 (high), 2026-03-25: NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using ACLs on…
- CVE-2026-29785 - CVSS 7.5 (high), 2026-03-25: NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.14 and 2.12.5, if the nats-server has…
- CVE-2026-27889 - CVSS 7.5 (high), 2026-03-25: NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.2.0 and prior to versions 2.11.14 and…
- CVE-2026-33215 - CVSS 6.5 (medium), 2026-03-24: NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to…
- CVE-2026-27571 - CVSS 7.5 (high), 2026-02-24: NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling of NATS messages handles compressed…
- CVE-2023-46129 - CVSS 7.5 (high), 2023-10-31: NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The…
- CVE-2023-47090 - CVSS 6.5 (medium), 2023-10-30: NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for…
- CVE-2022-28357 - CVSS 9.8 (critical), 2023-09-19: NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account.
- CVE-2022-26652 - CVSS 6.5 (medium), 2022-03-10: NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams. nats-streaming-server…
- CVE-2022-24450 - CVSS 8.8 (high), 2022-02-08: NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the…
- CVE-2021-3127 - CVSS 7.5 (high), 2021-03-16: NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled.
- CVE-2020-28466 - CVSS 7.5 (high), 2021-03-07: This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a…
- CVE-2020-26521 - CVSS 7.5 (high), 2020-11-06: The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code).
- CVE-2020-26892 - CVSS 9.8 (critical), 2020-11-06: The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled.
- CVE-2019-13126 - CVSS 7.5 (high), 2019-07-29: An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted request. If authentication is enabled, then…
