Identity Spoofing Vulnerability in NATS-Server Messaging System
CVE-2026-33223

6.4MEDIUM

Key Information:

Vendor

Nats-io

Status
Nats-server
Vendor
CVE Published:
25 March 2026

What is CVE-2026-33223?

The NATS-Server, a high-performance messaging system for cloud and edge applications, has a significant vulnerability that affects versions prior to 2.11.15 and 2.12.6. The issue lies in the message header Nats-Request-Info:, which is designed to guarantee the identity of clients. However, due to ineffective stripping of this header from incoming messages, an attacker with valid credentials can impersonate a legitimate client. This spoofing can lead to unauthorized access to services dependent on the integrity of this header. The updated versions have mitigated this vulnerability, and no known workarounds are available to protect against this threat.

Affected Version(s)

nats-server < 2.11.15 < 2.11.15

nats-server >= 2.12.0-RC.1, < 2.12.6 < 2.12.0-RC.1, 2.12.6

References

https://github.com/nats-io/nats-server/security/advisorie...
x_refsource_CONFIRM
https://advisories.nats.io/CVE/secnote-2026-09.txt
x_refsource_MISC

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.