NATS Server vulnerabilities

In NATS Server prior to versions 2.14.3 and 2.12.12, a client could be registered as the configured no_auth_user through a parser path used when the first client operation was not CONNECT, bypassing user-level connection restrictions such as allowed_connection_types or proxy_required that normal authentication would apply.

A vulnerability in NATS Server allows an unauthenticated client to send a WebSocket request for the MQTT protocol even when MQTT is not configured. This leads to access to uninitialized MQTT state and crashes the server process.

A vulnerability in NATS Server before versions 2.14.3 and 2.12.12 allows a client to send connection monitoring requests with pagination Offset and Limit values that cause internal arithmetic overflow, potentially crashing the server.

In NATS Server prior to versions 2.14.3 and 2.12.8, message trace destination checks were applied to ordinary client connections but not consistently to messages arriving through leafnode connections, allowing a leafnode operator to send trace events to subjects that would not otherwise be permitted and to use trace-only behavior to prevent normal delivery or storage of affected messages.

In NATS Server, when no_auth_user is configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an unauthenticated peer to bypass inter-server CONNECT authentication and operate with the privileges associated with that connection type.

A vulnerability in NATS Server allows an authenticated user to receive messages on denied subjects when a wildcard subscription overlaps with a configured wildcard deny rule but is not a subset of it. Additionally, queue subscriptions can affect delivery to legitimate queue consumers.

In NATS Server, an authenticated user with subscription deny permissions can bypass a plain subject deny rule by using a queue subscription. This occurs because queue-specific deny evaluation can override the plain subject deny result when the queue name itself is not denied.

In NATS Server before versions 2.12.8 and 2.11.17, an unauthenticated peer with network access to a leafnode listener with compression enabled could crash the server by sending repeated leafnode INFO protocol messages before authentication and account setup completed.

In NATS Server before versions 2.14.3 and 2.12.12, an authenticated MQTT client could subscribe to the internal $MQTT.deliver.pubrel subject family, bypassing configured subscribe permissions and exposing MQTT QoS2 protocol metadata for sessions in the account.

A vulnerability in the NATS Server allows an MQTT client to inject protocol control characters into subscription filters, which are later forwarded as NATS protocol data to route or leafnode connections, potentially corrupting the protocol stream and enabling unauthorized NATS operations.

An unauthenticated MQTT client can cause the NATS server to retain large incomplete MQTT CONNECT packets before authentication completes, consuming server memory while waiting for the advertised packet length. This affects versions prior to 2.14.3 and 2.12.12.

In NATS Server versions prior to 2.14.3 and 2.12.12, a vulnerability was found in MQTT message handling. The delivery paths for retained messages and QoS1+ durable replay did not recheck the original topic before sending the MQTT PUBLISH to the subscriber, potentially bypassing configured subscribe deny rules.

A vulnerability in NATS-Server exposes static credentials passed via command-line arguments (argv) through the `/debug/vars` endpoint. If the monitoring port is enabled, any user with access to it can read these credentials.

A vulnerability in NATS-Server before versions 2.11.15 and 2.12.6 allows a malicious client to cause unbounded memory usage before authentication via WebSockets connection. The attack requires sending a corresponding amount of data and is a milder variant of CVE-2026-27571.

A vulnerability in NATS-Server before versions 2.11.15 and 2.12.6 allows a client with access to the leafnode port to send a malformed message pre-authentication, causing the server to crash.

In NATS-Server prior to versions 2.11.15 and 2.12.6, ACLs on message subjects were not applied in the $MQTT.> namespace, allowing MQTT clients to bypass ACL checks for MQTT subjects. The vulnerability is fixed in versions 2.11.15 and 2.12.6.

In NATS-Server prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords, MQTT passwords are incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring endpoints.

A vulnerability in NATS-Server allows an attacker to remotely trigger a panic and crash the server before authentication. The issue occurs when leafnode configuration is enabled (not default) and compression is enabled (default for leafnodes).

In NATS-Server versions 2.2.0 through 2.11.14 and 2.12.5, a missing sanity check on a WebSockets frame can trigger a server panic. This vulnerability occurs before authentication and is exposed to anyone who can connect to the websockets port.