GitHub Advisoryadvisory · Go

GHSA-vprv-35vv-q339 NATS has pre-auth server panic via leafnode handling

HIGH Published 2026-03-24 Modified 2026-03-27 Official page ↗
Aliases
CVE-2026-33218
Ecosystem
Go
Packages
github.com/nats-io/nats-server/v2, github.com/nats-io/nats-server
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-20
Reviewed
2026-03-24

Affected packages

• Go github.com/nats-io/nats-server/v2: < 2.11.15 → fixed in 2.11.15 • Go github.com/nats-io/nats-server/v2: >= 2.12.0-RC.1, < 2.12.6 → fixed in 2.12.6 • Go github.com/nats-io/nats-server: all versions (no fix yet)

Description

Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The nats-server allows hub/spoke topologies using "leafnode" connections by other nats-servers. Problem Description A client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-authentication. Affected Versions Any version before v2.12.6 or v2.11.15 Workarounds 1. Disable leafnode support if not needed. 2. Restrict network connections to your leafnode port, if plausible without compromising the service offered. References • This document is canonically: • GHSA advisory: • MITRE CVE entry:

Related

Alias · CVE (1)

  • CVE-2026-33218 NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References