Threat Intelligence Database

NATS Server versions prior to 2.14.3 and 2.12.12 contain an incorrect authorization vulnerability. A client could be registered as the configured no_auth_user via a parser path triggered when the first client operation was not CONNECT. This bypasses user-level connection restrictions such as allowed_connection_types or proxy_required that normal authentication would enforce. The issue is fixed in versions 2.14.3 and 2.12.12.

NATS Server versions prior to 2.14.3 and 2.12.12 contain a vulnerability where a WebSocket listener can route MQTT-over-WebSocket requests into MQTT handling even if MQTT is not configured. This allows an unauthenticated client with access to the WebSocket listener to reach uninitialized MQTT state and crash the server process. The issue is fixed in versions 2.14.3 and 2.12.12.

NATS Server versions prior to 2.12.12 and 2.14.3 contain an integer overflow vulnerability in the handling of Connz pagination Offset and Limit values. A client sending account-scoped connection monitoring requests with specially crafted values can cause the server to crash. This issue has been fixed in versions 2.12.12 and 2.14.3.

NATS Server versions prior to 2.12.8 and 2.14.3 contain an authorization flaw where message trace destination checks are inconsistently applied to messages arriving via leafnode connections. This allows a leafnode operator to send trace events to unauthorized subjects and use trace-only behavior to interfere with normal message delivery or storage. The issue is addressed in versions 2.12.8 and 2.14.3.

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an unauthenticated peer to bypass inter-server CONNECT authentication and operate with the privileges associated with that connection type. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16.

NATS Server versions prior to 2.14.0, 2.12.7, and 2.11.16 contain an improper authorization vulnerability where authenticated users could receive messages on subjects they are denied access to due to overlapping wildcard subscription rules. This issue affects message delivery and queue subscriptions. The vulnerability is fixed in versions 2.14.0, 2.12.7, and 2.11.16.

A NULL pointer dereference vulnerability exists in nats-io nats-server versions prior to 2.11.17 and 2.12.8. An unauthenticated attacker with network access to a leafnode listener that has compression enabled can crash the server by sending repeated leafnode INFO protocol messages during the pre-authentication handshake. This issue is fixed in versions 2.11.17 and 2.12.8.

NATS Server versions prior to 2.12.12 and between 2.12.12 and before 2.14.3 contain an authorization vulnerability. An authenticated MQTT client could subscribe to the internal $MQTT.deliver.pubrel subject family, bypassing configured subscribe permissions and exposing MQTT QoS2 protocol metadata for sessions in the account. This issue is addressed in versions 2.14.3 and 2.12.12.

NATS Server versions prior to 2.14.1 and 2.12.9 contain a vulnerability where an MQTT client can inject protocol control characters into subscription filters. These characters are forwarded as NATS protocol data to route or leafnode connections, corrupting the protocol stream and enabling injection of unintended NATS protocol operations. This vulnerability is identified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The issue is fixed in versions 2.14.1 and 2.12.9.

NATS Server versions prior to 2.12.12 and 2.14.3 contain a vulnerability where an unauthenticated MQTT client can cause uncontrolled resource consumption by sending large incomplete MQTT CONNECT packets. This leads to the server retaining these packets in memory while waiting for the full packet, potentially exhausting server memory. The issue is fixed in versions 2.12.12 and 2.14.3.