Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GO-2026-4829
  • Go/github.com/nats-io/nats-server
  • Go/github.com/nats-io/nats-server/v2
 NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server 26 Mar
  • Fix available
GO-2026-4830
  • Go/github.com/nats-io/nats-server
  • Go/github.com/nats-io/nats-server/v2
 NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server 26 Mar
  • Fix available
GO-2026-4831
  • Go/github.com/nats-io/nats-server
  • Go/github.com/nats-io/nats-server/v2
 NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server 26 Mar
  • Fix available
GO-2026-4832
  • Go/github.com/nats-io/nats-server
  • Go/github.com/nats-io/nats-server/v2
 NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server 26 Mar
  • Fix available
GO-2026-4833
  • Go/github.com/nats-io/nats-server
  • Go/github.com/nats-io/nats-server/v2
 NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server 26 Mar
  • Fix available
GO-2026-4834
  • Go/github.com/nats-io/nats-server
  • Go/github.com/nats-io/nats-server/v2
 NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server 26 Mar
  • Fix available
GO-2026-4835
  • Go/github.com/nats-io/nats-server
  • Go/github.com/nats-io/nats-server/v2
 NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server 26 Mar
  • Fix available
GO-2026-4836
  • Go/github.com/nats-io/nats-server
  • Go/github.com/nats-io/nats-server/v2
 NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server 26 Mar
  • Fix available
GO-2026-4837
  • Go/github.com/nats-io/nats-server
  • Go/github.com/nats-io/nats-server/v2
 NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server 26 Mar
  • Fix available
GO-2026-4841
  • Go/github.com/nats-io/nats-server
  • Go/github.com/nats-io/nats-server/v2
 NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server 26 Mar
  • Fix available
GO-2026-4826
  • Go/github.com/nats-io/nats-server
  • Go/github.com/nats-io/nats-server/v2
 NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server 26 Mar
  • Fix available
GO-2026-4827
  • Go/github.com/nats-io/nats-server
  • Go/github.com/nats-io/nats-server/v2
 NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server 26 Mar
  • Fix available
GO-2026-4828
  • Go/github.com/nats-io/nats-server
  • Go/github.com/nats-io/nats-server/v2
 NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server 26 Mar
  • Fix available
GHSA-pq2q-rcw4-3hr6
  • Go/github.com/nats-io/nats-server
  • Go/github.com/nats-io/nats-server/v2
 NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead 25 Mar
  • Fix available
  • Severity - 7.5 (High)
GHSA-3f24-pcvm-5jqc
  • Go/github.com/nats-io/nats-server
  • Go/github.com/nats-io/nats-server/v2
 NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching 24 Mar
  • Fix available
  • Severity - 4.2 (Medium)
GHSA-55h8-8g96-x4hj
  • Go/github.com/nats-io/nats-server
  • Go/github.com/nats-io/nats-server/v2
 NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers 24 Mar
  • Fix available
  • Severity - 6.4 (Medium)
Load more...