nats-io vulnerabilities
28 published CVEs name nats-io among the affected products.
- 28Published CVEs28 of them scored
- 26Last 12 monthspublished in the last year
- 1Critical12 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-58208
NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled
nats-io · nats-server
Medium6.8 - CVE-2026-58211
NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions
nats-io · nats-server
Medium5.4 - CVE-2026-58207
NATS Server: Remote crash via integer overflow in Connz pagination
nats-io · nats-server
High7.7 - CVE-2026-58210
NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory
nats-io · nats-server
High7.5 - CVE-2026-58209
NATS Server: MQTT retained and QoS replay bypass subscribe deny filters
nats-io · nats-server
Medium4.3 - CVE-2026-58214
NATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217)
nats-io · nats-server
Medium4.3 - CVE-2026-58254
NATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission check
nats-io · nats-server
Medium5.3 - CVE-2026-58213
NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection
nats-io · nats-server
High7.1 - CVE-2026-58250
NATS Server: Pre-auth server crash via double INFO in leafnode handshake
nats-io · nats-server
High7.5 - CVE-2026-58252
NATS Server: Subscribe Authz Bypass via Wildcard-Overlap
nats-io · nats-server
Medium6.5