Identity Spoofing Vulnerability in NATS-Server Messaging System
CVE-2026-33223
What is CVE-2026-33223?
The NATS-Server, a high-performance messaging system for cloud and edge applications, has a significant vulnerability that affects versions prior to 2.11.15 and 2.12.6. The issue lies in the message header Nats-Request-Info:, which is designed to guarantee the identity of clients. However, due to ineffective stripping of this header from incoming messages, an attacker with valid credentials can impersonate a legitimate client. This spoofing can lead to unauthorized access to services dependent on the integrity of this header. The updated versions have mitigated this vulnerability, and no known workarounds are available to protect against this threat.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
nats-server < 2.11.15 < 2.11.15
nats-server >= 2.12.0-RC.1, < 2.12.6 < 2.12.0-RC.1, 2.12.6