PT-2026-27615 · Nats.Io · Nats Server

Published 2026-03-24 · Updated 2026-05-21 · CVE-2026-33218

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions NATS-Server versions prior to 2.11.15 NATS-Server versions prior to 2.12.6

Description NATS-Server is a high-performance server for NATS.io, a cloud and edge native messaging system. A client connected to the leafnode port can crash the server with a specifically crafted, malformed message during pre-authentication. The server supports hub/spoke topologies using leafnode connections from other nats-servers.

Recommendations Versions prior to 2.11.15 should be updated to version 2.11.15 or later. Versions prior to 2.12.6 should be updated to version 2.12.6 or later. If leafnode support is not needed, disable it. Restrict network connections to the leafnode port if possible without impacting service.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BIT-NATS-2026-33218

CVE-2026-33218

GHSA-VPRV-35VV-Q339

GO-2026-4837

SUSE-SU-2026:1135-1

Affected Products

Nats Server

References · 156

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33218.json · Exploit
• https://github.com/nats-io/nats-server/security/advisories/GHSA-vprv-35vv-q339 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-GOBINARY-CVE-2026-33218 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33218 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-nats-2026-33218 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33218 · Security Note
• https://advisories.nats.io/CVE/secnote-2026-10.txt · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33218 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4837 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vprv-35vv-q339 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33218 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-33218 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33218 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33218 · Vendor Advisory