Nats-server

This hub aggregates every CVE we track for Nats-server, a product in the ai ml space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Nats-server.

• CVE-2026-58208NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled6.8Jul 8, 2026
• CVE-2026-58211NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions5.4Jul 8, 2026
• CVE-2026-58207NATS Server: Remote crash via integer overflow in Connz pagination7.7Jul 8, 2026
• CVE-2026-58210NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory7.5Jul 8, 2026
• CVE-2026-58209NATS Server: MQTT retained and QoS replay bypass subscribe deny filters4.3Jul 8, 2026
• CVE-2026-58214NATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217)4.3Jul 8, 2026
• CVE-2026-58254NATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission check6.5Jul 8, 2026
• CVE-2026-58213NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection7.1Jul 8, 2026
• CVE-2026-58250NATS Server: Pre-auth server crash via double INFO in leafnode handshake7.5Jul 8, 2026
• CVE-2026-58252NATS Server: Subscribe Authz Bypass via Wildcard-Overlap6.5Jul 8, 2026
• CVE-2026-58253NATS Server: Route API Auth Bypass8.8Jul 8, 2026
• CVE-2026-58251NATS Server: Queue Subscribe Authz Bypass6.5Jul 8, 2026
• CVE-2026-33249NATS: Message tracing can be redirected to arbitrary subject4.3Mar 25, 2026
• CVE-2026-33223NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing6.4Mar 25, 2026
• CVE-2026-33248NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching4.2Mar 25, 2026