CVEs we hold for Nats-io

Records whose assigning authority named Nats-io as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-58254NATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission checknats-io nats-server

CVE-2026-58253NATS Server: Route API Auth Bypassnats-io nats-server

CVE-2026-58252NATS Server: Subscribe Authz Bypass via Wildcard-Overlapnats-io nats-server

CVE-2026-58251NATS Server: Queue Subscribe Authz Bypassnats-io nats-server

CVE-2026-58250NATS Server: Pre-auth server crash via double INFO in leafnode handshakenats-io nats-server

CVE-2026-58214NATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217)nats-io nats-server

CVE-2026-58213NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injectionnats-io nats-server

CVE-2026-58211NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictionsnats-io nats-server

CVE-2026-58210NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memorynats-io nats-server

CVE-2026-58209NATS Server: MQTT retained and QoS replay bypass subscribe deny filtersnats-io nats-server

CVE-2026-58208NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enablednats-io nats-server

CVE-2026-58207NATS Server: Remote crash via integer overflow in Connz paginationnats-io nats-server

CVE-2026-33249NATS: Message tracing can be redirected to arbitrary subjectnats-io nats-server

CVE-2026-33248NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matchingnats-io nats-server

CVE-2026-33247NATS credentials are exposed in monitoring port via command-line argvnats-io nats-server

CVE-2026-33246NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headersnats-io nats-server

CVE-2026-33223NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofingnats-io nats-server

CVE-2026-33222NATS JetStream has an authorization bypass through its Management APInats-io nats-server

CVE-2026-33219NATS is vulnerable to pre-auth DoS through WebSockets client servicenats-io nats-server

CVE-2026-33218NATS has pre-auth server panic via leafnode handlingnats-io nats-server

CVE-2026-33217NATS allows MQTT clients to bypass ACL checksnats-io nats-server

CVE-2026-33216NATS has MQTT plaintext password disclosurenats-io nats-server

CVE-2026-33215NATS is vulnerable to MQTT hijacking via Client IDnats-io nats-server

CVE-2026-29785NATS Server panic via malicious compression on leafnode portnats-io nats-server

CVE-2026-27889NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsReadnats-io nats-server

CVE-2026-27571nats-server websockets are vulnerable to pre-auth memory DoSnats-io nats-server

CVE-2025-30215NATS-Server Fails to Authorize Certain Jetstream Admin APIsnats-io nats-server

CVE-2023-46129xkeys Seal encryption used fixed key for all encryptionnats-io nkeys

28 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.