Product by Nats-io
Nats-server
28 known vulnerabilities in Nats-server (Nats-io), 0 of them actively exploited (CISA KEV).
Key figures
28
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-58210 | NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory | 7.5 | |
| High | CVE-2026-58250 | NATS Server: Pre-auth server crash via double INFO in leafnode handshake | 7.5 | |
| High | CVE-2026-58208 | Nats-io Nats-server: Uncaught Exception | 7.5 | |
| Critical | CVE-2025-30215 | NATS-Server Fails to Authorize Certain Jetstream Admin APIs | 9.6 | |
| High | CVE-2026-29785 | NATS Server panic via malicious compression on leafnode port | 7.5 | |
| High | CVE-2026-33218 | NATS has pre-auth server panic via leafnode handling | 7.5 | |
| High | CVE-2026-58253 | NATS Server: Route API Auth Bypass | 8.8 | |
| High | CVE-2026-27889 | NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead | 7.5 | |
| High | CVE-2026-58207 | NATS Server: Remote crash via integer overflow in Connz pagination | 6.5 | |
| High | CVE-2026-58213 | Nats-io Nats-server: Injection | 7.1 | |
| High | CVE-2026-33216 | NATS has MQTT plaintext password disclosure | 8.6 | |
| Medium | CVE-2026-58252 | NATS Server: Subscribe Authz Bypass via Wildcard-Overlap | 6.5 | |
| Medium | CVE-2026-58251 | NATS Server: Queue Subscribe Authz Bypass | 6.5 | |
| High | CVE-2026-33247 | NATS credentials are exposed in monitoring port via command-line argv | 7.4 | |
| High | CVE-2026-27571 | nats-server websockets are vulnerable to pre-auth memory DoS | 5.9 | |
| Medium | CVE-2026-33219 | NATS is vulnerable to pre-auth DoS through WebSockets client service | 5.3 | |
| Medium | CVE-2026-58254 | Nats-io Nats-server: Incorrect Authorization | 6.5 | |
| High | CVE-2026-33217 | NATS allows MQTT clients to bypass ACL checks | 7.1 | |
| High | CVE-2023-46129 | xkeys Seal encryption used fixed key for all encryption | 7.5 | |
| Medium | CVE-2026-58211 | NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions | 5.4 | |
| Medium | CVE-2026-33215 | NATS is vulnerable to MQTT hijacking via Client ID | 6.5 | |
| Medium | CVE-2026-33223 | NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing | 6.4 | |
| Medium | CVE-2026-58214 | Nats-io Nats-server: Incorrect Authorization | 4.3 | |
| Medium | CVE-2026-58209 | NATS Server: MQTT retained and QoS replay bypass subscribe deny filters | 4.3 | |
| Medium | CVE-2026-33246 | NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers | 6.4 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 27sans-atrisk-mail,