MEDIUM4.2Go
GHSA-3f24-pcvm-5jqc· BIT-nats-2026-33248, CVE-2026-33248NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching
Modified: 9/10/2026
package
Go/github.com/nats-io/nats-server
pkg:go/github.com/nats-io/nats-server
HIGH7.5Go
GHSA-52jh-2xxh-pwh6· BIT-nats-2026-29785, CVE-2026-29785NATS Server panic via malicious compression on leafnode port
Modified: 9/10/2026
MEDIUM6.4Go
GHSA-55h8-8g96-x4hj· BIT-nats-2026-33246, CVE-2026-33246NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers
Modified: 9/10/2026
MEDIUM5.3Go
GHSA-8r68-gvr4-jh7j· BIT-nats-2026-33219, CVE-2026-33219NATS is vulnerable to pre-auth DoS through WebSockets client service
Modified: 9/10/2026
MEDIUM4.9Go
GHSA-9983-vrx2-fg9c· BIT-nats-2026-33222, CVE-2026-33222NATS JetStream has an authorization bypass through its Management API
Modified: 9/10/2026
HIGH7.1Go
GHSA-jxxm-27vp-c3m5· BIT-nats-2026-33217, CVE-2026-33217NATS allows MQTT clients to bypass ACL checks
Modified: 9/10/2026
HIGH7.5Go
GHSA-m4jx-6526-vvhm· BIT-nats-2020-28466, CVE-2020-28466Denial of service in github.com/nats-io/nats-server/server
Modified: 9/10/2026
HIGH7.5Go
GHSA-pq2q-rcw4-3hr6· BIT-nats-2026-27889, CVE-2026-27889NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead
Modified: 9/10/2026
MEDIUM6.4Go
GHSA-pwx7-fx9r-hr4h· BIT-nats-2026-33223, CVE-2026-33223NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing
Modified: 9/10/2026
MEDIUM5.9Go
GHSA-qrvq-68c2-7grw· BIT-nats-2026-27571, CVE-2026-27571nats-server websockets are vulnerable to pre-auth memory DoS
Modified: 9/10/2026
HIGH8.6Go
GHSA-v722-jcv5-w7mc· BIT-nats-2026-33216, CVE-2026-33216NATS has MQTT plaintext password disclosure
Modified: 9/10/2026
CRITICAL9.8Go
GHSA-vpjc-4jcv-jc29· CVE-2022-28357, GO-2023-2066NATS nats-server allows directory traversal via unintended path to a management action
Modified: 8/21/2024
HIGH7.5Go
GHSA-vprv-35vv-q339· BIT-nats-2026-33218, CVE-2026-33218NATS has pre-auth server panic via leafnode handling
Modified: 9/10/2026
—Go
GO-2022-0307· BIT-nats-2022-24450, CVE-2022-24450Incorrect Authorization in NATS nats-server in github.com/nats-io/nats-server
Modified: 3/3/2026
—Go
GO-2022-0351· BIT-nats-2022-26652, CVE-2022-26652Arbitrary file write in nats-server in github.com/nats-io/nats-server
Modified: 3/3/2026
—Go
GO-2022-0398· GHSA-gwj5-3vfq-q992Import loops in account imports, nats-server DoS in github.com/nats-io/nats-server
Modified: 2/4/2026
—Go
GO-2022-0852· CVE-2019-13126, GHSA-jp4j-47f9-2vc3Integer Overflow or Wraparound in NATS Server in github.com/nats-io/nats-server
Modified: 2/4/2026
—Go
GO-2022-0855· BIT-nats-2020-28466, CVE-2020-28466Denial of service in github.com/nats-io/nats-server/server in github.com/nats-io/nats-server
Modified: 7/8/2026
—Go
GO-2023-2066· CVE-2022-28357, GHSA-vpjc-4jcv-jc29NATS nats-server allows directory traversal via unintended path to a management action in github.com/nats-io/nats-server
Modified: 3/3/2026
—Go
GO-2024-2850· CVE-2021-32026, GHSA-jj54-5q2m-q7pjNATS server TLS missing ciphersuite settings when CLI flags used in github.com/nats-io/nats-server
Modified: 2/4/2026
—Go
GO-2024-2980· CVE-2022-29946, GHSA-2h2x-8hh2-mfq8NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects in github.com/nats-io/nats-server
Modified: 3/3/2026
—Go
GO-2026-4533· BIT-nats-2026-27571, CVE-2026-27571nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server
Modified: 3/2/2026
—Go
GO-2026-4826· BIT-nats-2026-33249, CVE-2026-33249NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server
Modified: 3/30/2026
—Go
GO-2026-4827· BIT-nats-2026-33247, CVE-2026-33247NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server
Modified: 3/27/2026
—Go
GO-2026-4828· BIT-nats-2026-33248, CVE-2026-33248NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server
Modified: 3/27/2026
—Go
GO-2026-4829· BIT-nats-2026-29785, CVE-2026-29785NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server
Modified: 3/31/2026
—Go
GO-2026-4830· BIT-nats-2026-33246, CVE-2026-33246NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server
Modified: 3/27/2026
—Go
GO-2026-4831· BIT-nats-2026-33219, CVE-2026-33219NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server
Modified: 3/27/2026
—Go
GO-2026-4832· BIT-nats-2026-33222, CVE-2026-33222NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server
Modified: 3/27/2026
—Go
GO-2026-4833· BIT-nats-2026-33215, CVE-2026-33215NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server
Modified: 3/27/2026
—Go
GO-2026-4834· BIT-nats-2026-33217, CVE-2026-33217NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server
Modified: 3/27/2026
—Go
GO-2026-4835· BIT-nats-2026-33223, CVE-2026-33223NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server
Modified: 3/27/2026
—Go
GO-2026-4836· BIT-nats-2026-33216, CVE-2026-33216NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server
Modified: 3/27/2026
—Go
GO-2026-4837· BIT-nats-2026-33218, CVE-2026-33218NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server
Modified: 3/27/2026
—Go
GO-2026-4841· BIT-nats-2026-27889, CVE-2026-27889NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server
Modified: 3/27/2026