Product by Go
Github.com/nats-io/nats-server
13 known vulnerabilities in Github.com/nats-io/nats-server (Go), 0 of them actively exploited (CISA KEV).
Key figures
13
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2020-28466 | Denial of Service (DoS) | 7.5 | |
| Critical | CVE-2022-28357 | Linux Foundation NATS (NATS Server): Path Traversal | 9.8 | |
| High | CVE-2026-29785 | NATS Server panic via malicious compression on leafnode port | 7.5 | |
| High | CVE-2026-33218 | NATS has pre-auth server panic via leafnode handling | 7.5 | |
| High | CVE-2026-27889 | NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead | 7.5 | |
| High | CVE-2026-33216 | NATS has MQTT plaintext password disclosure | 8.6 | |
| High | CVE-2026-27571 | nats-server websockets are vulnerable to pre-auth memory DoS | 5.9 | |
| Medium | CVE-2026-33219 | NATS is vulnerable to pre-auth DoS through WebSockets client service | 5.3 | |
| High | CVE-2026-33217 | NATS allows MQTT clients to bypass ACL checks | 7.1 | |
| Medium | CVE-2026-33223 | NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing | 6.4 | |
| Medium | CVE-2026-33246 | NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers | 6.4 | |
| Medium | CVE-2026-33222 | NATS JetStream has an authorization bypass through its Management API | 4.9 | |
| Medium | CVE-2026-33248 | NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching | 4.2 |