{"schema_version":1,"title":"github.com/nats-io/nats-server/v2 (Go) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 29 vulnerabilities in github.com/nats-io/nats-server/v2 (Go): 0 in the last 7 days and 0 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-33246, was published on 26 March 2026.","url":"https://junglewise.ai/threats/technologies/github-com-nats-io-nats-server-v2","json_url":"https://junglewise.ai/threats/technologies/github-com-nats-io-nats-server-v2.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/github-com-nats-io-nats-server-v2","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":6,"all_time":29,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":0,"last_365_days":14},"latest":[{"cve":"CVE-2026-33246","cvss":3.1,"epss":0.0024,"slug":"cve-2026-33246-nats-leafnode-connections-allow-spoofing-of-nats-request-info","title":"GO-2026-4830 - NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server","severity":"low","exploited":false,"published_at":"2026-03-26T20:33:05+00:00","url":"https://junglewise.ai/threats/cve-2026-33246-nats-leafnode-connections-allow-spoofing-of-nats-request-info"},{"cve":"CVE-2026-33215","cvss":3.1,"epss":0.0028,"slug":"cve-2026-33215-nats-is-vulnerable-to-mqtt-hijacking-via-client-id","title":"GO-2026-4833 - NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server","severity":"low","exploited":false,"published_at":"2026-03-26T20:33:05+00:00","url":"https://junglewise.ai/threats/cve-2026-33215-nats-is-vulnerable-to-mqtt-hijacking-via-client-id"},{"cve":"CVE-2026-33223","cvss":3.1,"epss":0.0024,"slug":"cve-2026-33223-nats-server-incomplete-stripping-of-nats-request-info-header","title":"GO-2026-4835 - NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server","severity":"low","exploited":false,"published_at":"2026-03-26T20:33:05+00:00","url":"https://junglewise.ai/threats/cve-2026-33223-nats-server-incomplete-stripping-of-nats-request-info-header"},{"cve":"CVE-2026-33222","cvss":3.1,"epss":0.0034,"slug":"cve-2026-33222-nats-jetstream-has-an-authorization-bypass-through-its-management","title":"GO-2026-4832 - NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server","severity":"low","exploited":false,"published_at":"2026-03-26T20:33:05+00:00","url":"https://junglewise.ai/threats/cve-2026-33222-nats-jetstream-has-an-authorization-bypass-through-its-management"},{"cve":"CVE-2026-33249","cvss":3.1,"epss":0.0026,"slug":"cve-2026-33249-nats-message-tracing-can-be-redirected-to-arbitrary-subject","title":"GO-2026-4826 - NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server","severity":"low","exploited":false,"published_at":"2026-03-26T20:33:02+00:00","url":"https://junglewise.ai/threats/cve-2026-33249-nats-message-tracing-can-be-redirected-to-arbitrary-subject"},{"cve":"CVE-2026-33248","cvss":3.1,"epss":0.0017,"slug":"cve-2026-33248-nats-has-mtls-verify-and-map-authentication-bypass-via-incorrect","title":"GO-2026-4828 - NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server","severity":"low","exploited":false,"published_at":"2026-03-26T20:33:02+00:00","url":"https://junglewise.ai/threats/cve-2026-33248-nats-has-mtls-verify-and-map-authentication-bypass-via-incorrect"},{"cve":"CVE-2026-33247","cvss":7.4,"epss":0.0054,"slug":"cve-2026-33247-nats-server-sensitive-information-disclosure-in-monitoring","title":"NATS-Server sensitive information disclosure in monitoring endpoint","severity":"high","exploited":false,"published_at":"2026-03-25T20:16:33.223+00:00","url":"https://junglewise.ai/threats/cve-2026-33247-nats-server-sensitive-information-disclosure-in-monitoring"},{"cve":"CVE-2026-33219","cvss":5.3,"epss":0.01,"slug":"cve-2026-33219-nats-server-denial-of-service-in-websockets-component","title":"NATS-Server denial of service in WebSockets component","severity":"medium","exploited":false,"published_at":"2026-03-25T20:16:32.777+00:00","url":"https://junglewise.ai/threats/cve-2026-33219-nats-server-denial-of-service-in-websockets-component"},{"cve":"CVE-2026-33218","cvss":7.5,"epss":0.0084,"slug":"cve-2026-33218-nats-server-denial-of-service-in-leafnode-handling","title":"NATS-Server denial of service in leafnode handling","severity":"high","exploited":false,"published_at":"2026-03-25T20:16:32.623+00:00","url":"https://junglewise.ai/threats/cve-2026-33218-nats-server-denial-of-service-in-leafnode-handling"},{"cve":"CVE-2026-33217","cvss":7.1,"epss":0.0037,"slug":"cve-2026-33217-nats-server-acl-bypass-in-mqtt-namespace","title":"NATS-Server ACL bypass in MQTT namespace","severity":"high","exploited":false,"published_at":"2026-03-25T20:16:32.473+00:00","url":"https://junglewise.ai/threats/cve-2026-33217-nats-server-acl-bypass-in-mqtt-namespace"},{"cve":"CVE-2026-33216","cvss":8.6,"epss":0.0063,"slug":"cve-2026-33216-nats-server-plaintext-password-disclosure-in-monitoring-endpoints","title":"NATS-Server plaintext password disclosure in monitoring endpoints","severity":"high","exploited":false,"published_at":"2026-03-25T20:16:32.32+00:00","url":"https://junglewise.ai/threats/cve-2026-33216-nats-server-plaintext-password-disclosure-in-monitoring-endpoints"},{"cve":"CVE-2026-29785","cvss":7.5,"epss":0.0097,"slug":"cve-2026-29785-nats-io-nats-server-null-pointer-dereference-in-leafnode-protocol","title":"nats-io nats-server NULL pointer dereference in leafnode protocol","severity":"high","exploited":false,"published_at":"2026-03-25T20:16:30.373+00:00","url":"https://junglewise.ai/threats/cve-2026-29785-nats-io-nats-server-null-pointer-dereference-in-leafnode-protocol"},{"cve":"CVE-2026-27889","cvss":7.5,"epss":0.0084,"slug":"cve-2026-27889-nats-server-denial-of-service-via-websocket-frame-length-overflow","title":"NATS Server denial of service via WebSocket frame length overflow","severity":"high","exploited":false,"published_at":"2026-03-25T20:16:27.21+00:00","url":"https://junglewise.ai/threats/cve-2026-27889-nats-server-denial-of-service-via-websocket-frame-length-overflow"},{"cve":"CVE-2026-27571","cvss":3.1,"epss":0.0074,"slug":"cve-2026-27571-nats-server-websockets-are-vulnerable-to-pre-auth-memory-dos","title":"GO-2026-4533 - nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server","severity":"low","exploited":false,"published_at":"2026-02-25T23:07:04+00:00","url":"https://junglewise.ai/threats/cve-2026-27571-nats-server-websockets-are-vulnerable-to-pre-auth-memory-dos"},{"cve":"CVE-2025-30215","cvss":9.6,"epss":0.0059,"slug":"cve-2025-30215-nats-server-authorization-bypass-in-jetstream-admin-apis","title":"NATS Server authorization bypass in JetStream admin APIs","severity":"critical","exploited":false,"published_at":"2025-04-15T21:45:00+00:00","url":"https://junglewise.ai/threats/cve-2025-30215-nats-server-authorization-bypass-in-jetstream-admin-apis"},{"cve":"CVE-2019-13126","cvss":3.1,"epss":0.0177,"slug":"cve-2019-13126-integer-overflow-or-wraparound-in-nats-server","title":"GO-2022-0852 - Integer Overflow or Wraparound in NATS Server in github.com/nats-io/nats-server","severity":"low","exploited":false,"published_at":"2024-08-21T15:29:04+00:00","url":"https://junglewise.ai/threats/cve-2019-13126-integer-overflow-or-wraparound-in-nats-server"},{"cve":"CVE-2020-28466","cvss":3.1,"epss":0.0373,"slug":"cve-2020-28466-denial-of-service-in-github-com-nats-io-nats-server-server","title":"GO-2022-0855 - Denial of service in github.com/nats-io/nats-server/server in github.com/nats-io/nats-server","severity":"low","exploited":false,"published_at":"2024-08-21T15:29:04+00:00","url":"https://junglewise.ai/threats/cve-2020-28466-denial-of-service-in-github-com-nats-io-nats-server-server"},{"slug":"go-2022-0398-import-loops-in-account-imports-nats-server-dos-in-github-0f9787de","title":"GO-2022-0398 - Import loops in account imports, nats-server DoS in github.com/nats-io/nats-server","severity":"info","exploited":false,"published_at":"2024-08-21T14:30:31+00:00","url":"https://junglewise.ai/threats/go-2022-0398-import-loops-in-account-imports-nats-server-dos-in-github-0f9787de"},{"cve":"CVE-2022-26652","cvss":3.1,"epss":0.0234,"slug":"cve-2022-26652-arbitrary-file-write-in-nats-server","title":"GO-2022-0351 - Arbitrary file write in nats-server in github.com/nats-io/nats-server","severity":"low","exploited":false,"published_at":"2024-08-21T14:30:29+00:00","url":"https://junglewise.ai/threats/cve-2022-26652-arbitrary-file-write-in-nats-server"},{"cve":"CVE-2022-24450","cvss":3.1,"epss":0.0133,"slug":"cve-2022-24450-incorrect-authorization-in-nats-nats-server","title":"GO-2022-0307 - Incorrect Authorization in NATS nats-server in github.com/nats-io/nats-server","severity":"low","exploited":false,"published_at":"2024-08-21T14:30:26+00:00","url":"https://junglewise.ai/threats/cve-2022-24450-incorrect-authorization-in-nats-nats-server"},{"cve":"CVE-2022-28357","cvss":3.1,"epss":0.0117,"slug":"cve-2022-28357-nats-nats-server-allows-directory-traversal-via-unintended-path","title":"GO-2023-2066 - NATS nats-server allows directory traversal via unintended path to a management action in github.com/nats-io/nats-server","severity":"low","exploited":false,"published_at":"2024-08-21T14:30:18+00:00","url":"https://junglewise.ai/threats/cve-2022-28357-nats-nats-server-allows-directory-traversal-via-unintended-path"},{"cve":"CVE-2022-29946","cvss":3.1,"epss":0.0048,"slug":"cve-2022-29946-nats-server-and-streaming-server-fails-to-enforce-negative-user","title":"GO-2024-2980 - NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects in github.com/nats-io/nats-server","severity":"low","exploited":false,"published_at":"2024-07-12T16:45:14+00:00","url":"https://junglewise.ai/threats/cve-2022-29946-nats-server-and-streaming-server-fails-to-enforce-negative-user"},{"cve":"CVE-2021-32026","slug":"cve-2021-32026-nats-server-tls-missing-ciphersuite-settings-when-cli-flags-used","title":"GO-2024-2850 - NATS server TLS missing ciphersuite settings when CLI flags used in github.com/nats-io/nats-server","severity":"info","exploited":false,"published_at":"2024-06-05T15:10:42+00:00","url":"https://junglewise.ai/threats/cve-2021-32026-nats-server-tls-missing-ciphersuite-settings-when-cli-flags-used"},{"cve":"CVE-2023-46129","cvss":3.1,"epss":0.0037,"slug":"cve-2023-46129-xkeys-seal-encryption-used-fixed-key-for-all-encryption","title":"GO-2023-2163 - Curve KeyPairs fail to encrypt in github.com/nats-io/nkeys","severity":"low","exploited":false,"published_at":"2023-11-02T21:47:24+00:00","url":"https://junglewise.ai/threats/cve-2023-46129-xkeys-seal-encryption-used-fixed-key-for-all-encryption"},{"cve":"CVE-2023-47090","epss":0.0066,"slug":"cve-2023-47090-nats-io-adding-accounts-for-just-the-system-account-adds-auth","title":"GO-2023-2133 - Authorization bypass in github.com/nats-io/nats-server/v2","severity":"info","exploited":false,"published_at":"2023-10-24T20:27:36+00:00","url":"https://junglewise.ai/threats/cve-2023-47090-nats-io-adding-accounts-for-just-the-system-account-adds-auth"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"github.com/mattermost/mattermost-server (Go)","slug":"github-com-mattermost-mattermost-server","vulnerabilities":274,"url":"https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server"},{"name":"github.com/mattermost/mattermost-server/v6 (Go)","slug":"github-com-mattermost-mattermost-server-v6","vulnerabilities":188,"url":"https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6"},{"name":"github.com/mattermost/mattermost-server/v5 (Go)","slug":"github-com-mattermost-mattermost-server-v5","vulnerabilities":186,"url":"https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5"},{"name":"github.com/mattermost/mattermost/server/v8 (Go)","slug":"github-com-mattermost-mattermost-server-v8","vulnerabilities":182,"url":"https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8"},{"name":"stdlib (Go)","slug":"go-stdlib","vulnerabilities":161,"url":"https://junglewise.ai/threats/technologies/go-stdlib"},{"name":"github.com/siyuan-note/siyuan/kernel (Go)","slug":"github-com-siyuan-note-siyuan-kernel","vulnerabilities":158,"url":"https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel"},{"name":"code.gitea.io/gitea (Go)","slug":"code-gitea-io-gitea","vulnerabilities":128,"url":"https://junglewise.ai/threats/technologies/code-gitea-io-gitea"},{"name":"gogs.io/gogs (Go)","slug":"gogs-io-gogs","vulnerabilities":82,"url":"https://junglewise.ai/threats/technologies/gogs-io-gogs"},{"name":"github.com/traefik/traefik (Go)","slug":"github-com-traefik-traefik","vulnerabilities":75,"url":"https://junglewise.ai/threats/technologies/github-com-traefik-traefik"},{"name":"github.com/usememos/memos (Go)","slug":"github-com-usememos-memos","vulnerabilities":75,"url":"https://junglewise.ai/threats/technologies/github-com-usememos-memos"},{"name":"github.com/traefik/traefik/v2 (Go)","slug":"github-com-traefik-traefik-v2","vulnerabilities":73,"url":"https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2"},{"name":"github.com/traefik/traefik/v3 (Go)","slug":"github-com-traefik-traefik-v3","vulnerabilities":68,"url":"https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v3"}],"technology":{"hub":true,"name":"github.com/nats-io/nats-server/v2 (Go)","slug":"github-com-nats-io-nats-server-v2","vendor":{"name":"Go","slug":"go","url":"https://junglewise.ai/threats/vendors/go"},"aliases":[],"homepage":"https://nats.io/","repo_url":"https://github.com/nats-io/nats-server","description":"NATS Server is a high-performance messaging system for cloud-native applications, IoT messaging, and microservices architectures.","url":"https://junglewise.ai/threats/technologies/github-com-nats-io-nats-server-v2"},"most_severe":[{"cve":"CVE-2025-30215","cvss":9.6,"epss":0.0059,"slug":"cve-2025-30215-nats-server-authorization-bypass-in-jetstream-admin-apis","title":"NATS Server authorization bypass in JetStream admin APIs","severity":"critical","exploited":false,"published_at":"2025-04-15T21:45:00+00:00","url":"https://junglewise.ai/threats/cve-2025-30215-nats-server-authorization-bypass-in-jetstream-admin-apis"},{"cve":"CVE-2026-33216","cvss":8.6,"epss":0.0063,"slug":"cve-2026-33216-nats-server-plaintext-password-disclosure-in-monitoring-endpoints","title":"NATS-Server plaintext password disclosure in monitoring endpoints","severity":"high","exploited":false,"published_at":"2026-03-25T20:16:32.32+00:00","url":"https://junglewise.ai/threats/cve-2026-33216-nats-server-plaintext-password-disclosure-in-monitoring-endpoints"},{"cve":"CVE-2026-29785","cvss":7.5,"epss":0.0097,"slug":"cve-2026-29785-nats-io-nats-server-null-pointer-dereference-in-leafnode-protocol","title":"nats-io nats-server NULL pointer dereference in leafnode protocol","severity":"high","exploited":false,"published_at":"2026-03-25T20:16:30.373+00:00","url":"https://junglewise.ai/threats/cve-2026-29785-nats-io-nats-server-null-pointer-dereference-in-leafnode-protocol"},{"cve":"CVE-2026-33218","cvss":7.5,"epss":0.0084,"slug":"cve-2026-33218-nats-server-denial-of-service-in-leafnode-handling","title":"NATS-Server denial of service in leafnode handling","severity":"high","exploited":false,"published_at":"2026-03-25T20:16:32.623+00:00","url":"https://junglewise.ai/threats/cve-2026-33218-nats-server-denial-of-service-in-leafnode-handling"},{"cve":"CVE-2026-27889","cvss":7.5,"epss":0.0084,"slug":"cve-2026-27889-nats-server-denial-of-service-via-websocket-frame-length-overflow","title":"NATS Server denial of service via WebSocket frame length overflow","severity":"high","exploited":false,"published_at":"2026-03-25T20:16:27.21+00:00","url":"https://junglewise.ai/threats/cve-2026-27889-nats-server-denial-of-service-via-websocket-frame-length-overflow"},{"cve":"CVE-2026-33247","cvss":7.4,"epss":0.0054,"slug":"cve-2026-33247-nats-server-sensitive-information-disclosure-in-monitoring","title":"NATS-Server sensitive information disclosure in monitoring endpoint","severity":"high","exploited":false,"published_at":"2026-03-25T20:16:33.223+00:00","url":"https://junglewise.ai/threats/cve-2026-33247-nats-server-sensitive-information-disclosure-in-monitoring"},{"cve":"CVE-2026-33217","cvss":7.1,"epss":0.0037,"slug":"cve-2026-33217-nats-server-acl-bypass-in-mqtt-namespace","title":"NATS-Server ACL bypass in MQTT namespace","severity":"high","exploited":false,"published_at":"2026-03-25T20:16:32.473+00:00","url":"https://junglewise.ai/threats/cve-2026-33217-nats-server-acl-bypass-in-mqtt-namespace"},{"cve":"CVE-2026-33219","cvss":5.3,"epss":0.01,"slug":"cve-2026-33219-nats-server-denial-of-service-in-websockets-component","title":"NATS-Server denial of service in WebSockets component","severity":"medium","exploited":false,"published_at":"2026-03-25T20:16:32.777+00:00","url":"https://junglewise.ai/threats/cve-2026-33219-nats-server-denial-of-service-in-websockets-component"},{"cve":"CVE-2020-28466","cvss":3.1,"epss":0.0373,"slug":"cve-2020-28466-denial-of-service-in-github-com-nats-io-nats-server-server","title":"GO-2022-0855 - Denial of service in github.com/nats-io/nats-server/server in github.com/nats-io/nats-server","severity":"low","exploited":false,"published_at":"2024-08-21T15:29:04+00:00","url":"https://junglewise.ai/threats/cve-2020-28466-denial-of-service-in-github-com-nats-io-nats-server-server"},{"cve":"CVE-2022-26652","cvss":3.1,"epss":0.0234,"slug":"cve-2022-26652-arbitrary-file-write-in-nats-server","title":"GO-2022-0351 - Arbitrary file write in nats-server in github.com/nats-io/nats-server","severity":"low","exploited":false,"published_at":"2024-08-21T14:30:29+00:00","url":"https://junglewise.ai/threats/cve-2022-26652-arbitrary-file-write-in-nats-server"}],"generated_at":"2026-09-27T03:07:00.185062+00:00"}