CVE-2026-27889

In NATS Server prior to versions 2.14.3 and 2.12.12, a client could be registered as the configured no_auth_user through a parser path used when the first client operation was not CONNECT, bypassing user-level connection restrictions such as allowed_connection_types or proxy_required that normal authentication would apply.

A vulnerability in NATS Server allows an unauthenticated client to send a WebSocket request for the MQTT protocol even when MQTT is not configured. This leads to access to uninitialized MQTT state and crashes the server process.

A vulnerability in NATS Server before versions 2.14.3 and 2.12.12 allows a client to send connection monitoring requests with pagination Offset and Limit values that cause internal arithmetic overflow, potentially crashing the server.

In NATS Server prior to versions 2.14.3 and 2.12.8, message trace destination checks were applied to ordinary client connections but not consistently to messages arriving through leafnode connections, allowing a leafnode operator to send trace events to subjects that would not otherwise be permitted and to use trace-only behavior to prevent normal delivery or storage of affected messages.

In NATS Server, when no_auth_user is configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an unauthenticated peer to bypass inter-server CONNECT authentication and operate with the privileges associated with that connection type.

A vulnerability in NATS Server allows an authenticated user to receive messages on denied subjects when a wildcard subscription overlaps with a configured wildcard deny rule but is not a subset of it. Additionally, queue subscriptions can affect delivery to legitimate queue consumers.

In NATS Server, an authenticated user with subscription deny permissions can bypass a plain subject deny rule by using a queue subscription. This occurs because queue-specific deny evaluation can override the plain subject deny result when the queue name itself is not denied.

In NATS Server before versions 2.12.8 and 2.11.17, an unauthenticated peer with network access to a leafnode listener with compression enabled could crash the server by sending repeated leafnode INFO protocol messages before authentication and account setup completed.

In NATS Server before versions 2.14.3 and 2.12.12, an authenticated MQTT client could subscribe to the internal $MQTT.deliver.pubrel subject family, bypassing configured subscribe permissions and exposing MQTT QoS2 protocol metadata for sessions in the account.

A vulnerability in the NATS Server allows an MQTT client to inject protocol control characters into subscription filters, which are later forwarded as NATS protocol data to route or leafnode connections, potentially corrupting the protocol stream and enabling unauthorized NATS operations.