nats-io has 7 CVEs on record between 2022 and 2026. The median CVSS is 6.5 (medium), with 2 rated critical. None have a confirmed exploitation report. Most affected products: github.com/nats-io/nats-server/v2 (4), github.com/nats-io/jwt (2), github.com/nats-io/nats-server (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 0 prev 0
Products
- github.com/nats-io/nats-server/v2 4
- github.com/nats-io/jwt 2
- github.com/nats-io/nats-server 1
Worst active — by depth score
CVE-2020-26892Critical· 9.8Incorrect handling of credential expiry by /nats-io/nats-server54CVE-2021-3127Criticalnats-io/jwt not enforcing checking of Import token permissions53CVE-2020-28466High· 7.5Denial of service in github.com/nats-io/nats-server/server42CVE-2023-47090HighNATS.io: Adding accounts for just the system account adds auth bypass41CVE-2022-26652Medium· 6.5Arbitrary file write in nats-server36
nats-io vulnerabilities
CVEs affecting nats-io, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-33246Medium· 6.4NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers
CVE-2026-33248Medium· 4.2NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching
CVE-2023-47090HighNATS.io: Adding accounts for just the system account adds auth bypass
NATS.io: Adding accounts for just the system account adds auth bypass
CVE-2022-26652Medium· 6.5Arbitrary file write in nats-server
Arbitrary file write in nats-server
CVE-2021-3127Criticalnats-io/jwt not enforcing checking of Import token permissions
nats-io/jwt not enforcing checking of Import token permissions
CVE-2020-28466High· 7.5Denial of service in github.com/nats-io/nats-server/server
Denial of service in github.com/nats-io/nats-server/server
CVE-2020-26892Critical· 9.8Incorrect handling of credential expiry by /nats-io/nats-server
Incorrect handling of credential expiry by /nats-io/nats-server