Remote Crash Vulnerability in NATS-Server by NATS.io
CVE-2026-33218

7.5HIGH

Key Information:

Vendor

Nats-io

Status
Nats-server
Vendor
CVE Published:
25 March 2026

What is CVE-2026-33218?

NATS-Server, the high-performance messaging server for NATS.io, is susceptible to a vulnerability that allows a client capable of connecting to the leafnode port to crash the server through a specially crafted malformed message sent before authentication. This issue affects versions prior to 2.11.15 and 2.12.6, which have been patched to address this flaw. Users are advised to update to the latest versions to secure their systems. Alternatively, it is recommended to disable leafnode support if it is unnecessary or to limit network access to the leafnode port to mitigate potential risks without disrupting service.

Affected Version(s)

nats-server < < 2.11.15 < < 2.11.15

nats-server >= 2.12.0-RC.1, < 2.12.6 < 2.12.0-RC.1, 2.12.6

References

https://github.com/nats-io/nats-server/security/advisorie...
x_refsource_CONFIRM
https://advisories.nats.io/CVE/secnote-2026-10.txt
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.