Nats-io vulnerabilities
We track 12 vulnerabilities in Nats-io products across 2 products. 12 are rated high or critical, and none are known to be exploited. The most recent was published on July 8, 2026.
Latest Nats-io vulnerabilities
- 7.5 High severity
nats-server: Uncaught Exception
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a WebSocket listener could route requests for the MQTT-over-WebSocket path into MQTT handling even when MQTT was not configured, allo
- 8.8 High severity
nats-server: Improper Authentication
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was configured, a parser fast path intended for ordinary client connections could also apply to route or l
- 7.5 High severity
nats-server: NULL Pointer Dereference
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.12.8 and 2.11.17, an unauthenticated peer with network access to a leafnode listener with compression enabled could crash the server during the pre-aut
- 7.1 High severity
nats-server: Improper Neutralization of Special Elements in Output Used by a Downstream Component
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.1 and 2.12.9, an MQTT client could include protocol control characters in subscription filters that were later forwarded as NATS protocol data to ro
- 7.5 High severity
nats-server: Uncontrolled Resource Consumption
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an unauthenticated MQTT client could cause the server to retain large incomplete MQTT CONNECT packets before authentication completed
- 7.5 High severity
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system.
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-authentication.
- 7.5 High severity
nats-server: Plaintext Storage of a Password
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity sta
- 7.5 High severity
nats-server: NULL Pointer Dereference
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.14 and 2.12.5, if the nats-server has the "leafnode" configuration enabled (not default), then anyone who can connect can crash the nats-serv
- 7.5 High severity
nats-server: Integer Overflow or Wraparound
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.2.0 and prior to versions 2.11.14 and 2.12.5, a missing sanity check on a WebSockets frame could trigger a server panic in the nats-server. Th
- 7.5 High severity
nats-server: Improper Handling of Highly Compressed Data (Data Amplification)
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling of NATS messages handles compressed messages via the WebSockets negotiated compression. Prior to versions 2.11.2 and 2.12.3, the implementat
- 9.6 Critical severity
nats-server: Improper Authentication
NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting from 2.2.0 but prior to 2.10.27 and 2.11.1, the management of JetStream assets happens with messages in the $JS. subject namespace in the sys
- 7.5 High severity
nkeys: Use of Hard-coded Cryptographic Key
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authen