Fedora: Security Advisory (FEDORA-2025-e8a6a13553)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2025-c4e168069a)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-47090

NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is...

CVE-2020-26149

NATS nats.js before 2.0.0-209, nats.ws before 1.0.0-111, and nats.deno before 1.0.0-9 allow credential disclosure from a client to a server...

CVE-2020-5910

In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System NATS messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized...

CVE-2019-13126

An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted request. If authentication is enabled, then the remote attacker must have first authenticated...

[SECURITY] Fedora 41 Update: golang-github-nats-io-nkeys-0.4.11-2.fc41

A public-key signature system based on Ed25519 for the NATS ecosystem...

[SECURITY] Fedora 42 Update: golang-github-nats-io-nkeys-0.4.11-2.fc42

A public-key signature system based on Ed25519 for the NATS ecosystem...

Improper Authorization

github.com/nats-io/nats-server is vulnerable to Improper Authorization. The vulnerability is due to missing access restrictions due to certain JetStream management API requests lacking proper access controls, allowing unauthorized administrative actions across accounts...

CBL Mariner 2.0 Security Update: telegraf (CVE-2025-30215)

The version of telegraf installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-30215 advisory. - NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In...

Azure Linux 3.0 Security Update: telegraf (CVE-2025-30215)

The version of telegraf installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-30215 advisory. - NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In...

GO-2025-3600 Missing ACLs on JavaScript APIs allowing privilege escalation github.com/nats-io/nats-server

Missing...

NATS-Server Fails to Authorize Certain Jetstream Admin APIs

...

BIT-NATS-2025-30215 NATS-Server Fails to Authorize Certain Jetstream Admin APIs

NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting from 2.2.0 but prior to 2.10.27 and 2.11.1, the management of JetStream assets happens with messages in the $JS. subject namespace in the system account; this is partially expose...

GHSA-FHG8-QXH5-7Q3W vulnerabilities

Vulnerabilities for packages: nats-server, nats-top...

CVE-2025-30215 vulnerabilities

Vulnerabilities for packages: nats-server, nats-top...

GHSA-FHG8-QXH5-7Q3W vulnerabilities

Vulnerabilities for packages: nats-server-fips, nats-top-fips, nats-server, prometheus-nats-exporter, nats-top...

CVE-2025-30215 vulnerabilities

Vulnerabilities for packages: nats-server-fips, nats-top-fips, nats-server, prometheus-nats-exporter, nats-top...

CVE-2025-30215

A flaw was found in NATS-SERVER. In affected versions of NATS-SERVER, the management of JetStream assets happens with messages in the $JS. subject namespace in the system account; this is partially exposed into regular accounts to allow account holders to manage their assets. Some JS API requests...

DEBIAN-CVE-2025-30215

NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting from 2.2.0 but prior to 2.10.27 and 2.11.1, the management of JetStream assets happens with messages in the $JS. subject namespace in the system account; this is partially expose...