CVE-2026-33218: CWE-20: Improper Input Validation in nats-io nats-server
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-authentication. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, disable leafnode support if not needed or restrict network connections to the leafnode port, if plausible without compromising the service offered.
AI Analysis
Technical Summary
NATS-Server, a high-performance messaging server for NATS.io, contains an improper input validation vulnerability (CWE-20) in versions before 2.11.15 and 2.12.6. A client able to connect to the leafnode port can send a malformed message pre-authentication that causes the server to crash, resulting in a denial of service. The issue is fixed in versions 2.11.15 and 2.12.6. Workarounds include disabling leafnode support or restricting network connections to the leafnode port. The CVSS 3.1 base score is 7.5 (High), reflecting network attack vector, low complexity, no privileges or user interaction required, and impact limited to availability.
Potential Impact
Successful exploitation causes a denial of service by crashing the nats-server when a malformed message is sent to the leafnode port pre-authentication. There is no confidentiality or integrity impact reported. The server becomes unavailable until restarted or recovered.
Mitigation Recommendations
A fix is available in nats-server versions 2.11.15 and 2.12.6. Users should upgrade to these or later versions to remediate the vulnerability. As a workaround, if leafnode support is not needed, it should be disabled. Alternatively, network connections to the leafnode port should be restricted to trusted clients to reduce exposure.
CVE-2026-33218: CWE-20: Improper Input Validation in nats-io nats-server
Description
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-authentication. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, disable leafnode support if not needed or restrict network connections to the leafnode port, if plausible without compromising the service offered.
CVSS v3.1
Score 7.5high
Affected software
pkg:github/nats-io/nats-serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
NATS-Server, a high-performance messaging server for NATS.io, contains an improper input validation vulnerability (CWE-20) in versions before 2.11.15 and 2.12.6. A client able to connect to the leafnode port can send a malformed message pre-authentication that causes the server to crash, resulting in a denial of service. The issue is fixed in versions 2.11.15 and 2.12.6. Workarounds include disabling leafnode support or restricting network connections to the leafnode port. The CVSS 3.1 base score is 7.5 (High), reflecting network attack vector, low complexity, no privileges or user interaction required, and impact limited to availability.
Potential Impact
Successful exploitation causes a denial of service by crashing the nats-server when a malformed message is sent to the leafnode port pre-authentication. There is no confidentiality or integrity impact reported. The server becomes unavailable until restarted or recovered.
Mitigation Recommendations
A fix is available in nats-server versions 2.11.15 and 2.12.6. Users should upgrade to these or later versions to remediate the vulnerability. As a workaround, if leafnode support is not needed, it should be disabled. Alternatively, network connections to the leafnode port should be restricted to trusted clients to reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-17T23:23:58.314Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-33218","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:22347","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:21769","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:23345","vendor":"Red Hat"}]
Threat ID: 69c43f15f4197a8e3b7dafe4
Added to database: 03/25/2026, 20:01:25 UTC
Last enriched: 07/30/2026, 01:39:35 UTC
Last updated: 07/31/2026, 21:26:48 UTC
Views: 131
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.