CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2026-29785
High (7.5) in linuxfoundation nats-server. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in github.com/nats-io/nats-server/v2 2.11.14, 2.12.5.
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.14 and 2.12.5, if the nats-server has the "leafnode" configuration enabled (not default), then anyone who can connect can crash the nats-server by triggering a panic. This happens pre-authentication and requires that compression be enabled (which it is, by default, when leafnodes are used). Versions 2.11.14 and 2.12.5 contain a fix. As a workaround, disable compression on the leafnode port.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 52% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-476, CWE-409
- Published
- Modified
- Record from
- the NVD, synced
Affected
- linuxfoundation:nats-server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-52jh-2xxh-pwh6 | Go | github.com/nats-io/nats-server/v2 | <2.11.14 | 2.11.14 |
| GHSA-52jh-2xxh-pwh6 | Go | github.com/nats-io/nats-server/v2 | >=2.12.0-RC.1 <2.12.5 | 2.12.5 |
| GHSA-52jh-2xxh-pwh6 | Go | github.com/nats-io/nats-server | all versions | no fix published |
| GO-2026-4829 | Go | github.com/nats-io/nats-server | all versions | no fix published |
| GO-2026-4829 | Go | github.com/nats-io/nats-server/v2 | <2.11.14 >=2.12.0-RC.1 <2.12.5 | 2.11.14, 2.12.5 |
References
- https://advisories.nats.io/CVE/secnote-2026-04.txt
- https://github.com/nats-io/nats-server/commit/a1488de6f2ba6e666aef0f9cce0016f7f167d6a8
- https://github.com/nats-io/nats-server/security/advisories/GHSA-52jh-2xxh-pwh6
- https://access.redhat.com/errata/RHSA-2026:21769
- https://access.redhat.com/errata/RHSA-2026:22347