Description
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-authentication. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, disable leafnode support if not needed or restrict network connections to the leafnode port, if plausible without compromising the service offered.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
nats-io nats-server
< < 2.11.15affected>= 2.12.0-RC.1, < 2.12.6affected
References
- https://github.com/nats-io/nats-server/security/advisories/GHSA-vprv-35vv-q339 ↗
- https://advisories.nats.io/CVE/secnote-2026-10.txt ↗
- https://access.redhat.com/security/cve/CVE-2026-33218 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2451450 ↗
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33218.json ↗
- https://access.redhat.com/errata/RHSA-2026:22347 ↗
- https://access.redhat.com/errata/RHSA-2026:23345 ↗
- https://access.redhat.com/errata/RHSA-2026:21769 ↗