PT-2026-101221

Security vulnerability affects the nats-server-fips package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101319

Security vulnerability affects the nats-server-fips package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-102130

Security vulnerability affects the nats-server-fips package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100564

Security vulnerability affects the nats-server-fips package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-58210

A flaw was found in NATS Server. An unauthenticated remote attacker could send large, incomplete MQTT CONNECT packets to the server. This action causes the server to retain these packets, consuming significant memory before authentication is complete. This can lead to a denial of service DoS...

CVE-2026-58254

A flaw was found in NATS Server. Message trace destination checks, which ensure that trace events are sent to authorized subjects, were not consistently applied to messages originating from leafnode connections. This inconsistency allows a leafnode operator to bypass these checks and send trace...

CVE-2026-58214

A flaw was found in NATS Server, a high-performance messaging system. An authenticated MQTT Message Queuing Telemetry Transport client could bypass security permissions by subscribing to an internal subject family. This unauthorized access allows the client to view sensitive MQTT Quality of Servi...

CVE-2026-58211

A flaw was found in NATS Server, a high-performance messaging system. This vulnerability allows a client to bypass normal authentication and connection restrictions by registering as a "noauthuser" through a specific parser path. This occurs when the client's initial operation is not a standard...

CVE-2026-58209

A flaw was found in NATS Server. This vulnerability allows for unauthorized information disclosure where MQTT messages, intended to be denied based on subscription rules, are still delivered to subscribers. This occurs because the server's delivery paths do not consistently recheck the original...

CVE-2026-58213

A flaw was found in NATS Server. An authenticated MQTT client could exploit this by embedding protocol control characters within subscription filters. These characters would then be forwarded as NATS protocol data to route or leafnode connections, leading to the corruption of the protocol stream...

GO-2025-3600 vulnerabilities

Vulnerabilities for packages: nats-top, nats-server-fips, nats-top-fips, prometheus-nats-exporter, nats-server...

GO-2023-2163 vulnerabilities

Vulnerabilities for packages: nats, minio, k3s, nats-server...

GO-2025-3600 vulnerabilities

Vulnerabilities for packages: nats-top, nats-server...

GO-2023-2163 vulnerabilities

Vulnerabilities for packages: nats, minio, nats-server, k3s...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: harbor-cli, yunikorn-k8shim, nodetaint, wgcf, nri-mysql, kubernetes-dashboard-auth, conftest, migrate, kubeflow-katib, polaris, prometheus-operator, kubernetes-csi-external-health-monitor, opentofu, oauth2-proxy, harbor-registry, cilium-cli, hubble, k3s, kind,...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nats-server2.12: nats-server2.12-2.12.15-0.1.hum1 aarch64, x8664 nats-server2.12-2.12.15-0.1.hum1.src src...

JLSEC-2026-1132

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using mTLS for client identity, with verifyandmap to derive a NATS identity from the client certificate's Subject DN, certain patterns of RDN would not be...

JLSEC-2026-1152

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user could receive messages on denied subjects when a wildcard subscription overlapped with a configured wildcard deny rule but was not a subset...

JLSEC-2026-1126

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-authentication. Versions 2.11.15 and 2.12.6 contain ...

JLSEC-2026-1123

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12.5 patch the issu...