Skip to content
fr Sign in
7.5 High

CVE-2026-29785 NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system

Description

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.14 and 2.12.5, if the nats-server has the "leafnode" configuration enabled (not default), then anyone who can connect can crash the nats-server by triggering a panic. This happens pre-authentication and requires that compression be enabled (which it is, by default, when leafnodes are used). Versions 2.11.14 and 2.12.5 contain a fix. As a workaround, disable compression on the leafnode port.

Affected products and versions

Product Affected versions Fixed in
nats-server 2.12 2.12.0-RC.1 → < 2.12.5 2.12.5
nats-server 2.11 earliest → < 2.11.14 2.11.14
Multicluster Global Hub 1.4.5 1779579439 earliest → < 1779579439 1779579439
Multicluster Global Hub 1.5.4 1778867753 earliest → < 1778867753 1778867753
Multicluster Global Hub 1.6.2 1780167118 earliest → < 1780167118 1780167118
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat multicluster global hub 1.4.3 1779579439 earliest → < 1779579439 1779579439
Red Hat multicluster global hub 1.5.2 1778867753 earliest → < 1778867753 1778867753
Red Hat multicluster global hub 1.4.4 1779579439 earliest → < 1779579439 1779579439
Show the 8 other branches
Product Affected versions Fixed in
Red Hat multicluster global hub 1.6.0 1780167118 earliest → < 1780167118 1780167118
Red Hat multicluster global hub 1.5.0 1778867753 earliest → < 1778867753 1778867753
Multicluster Global Hub 1.5.7 1778867753 earliest → < 1778867753 1778867753
Multicluster Global Hub 1.6.5 1780167118 earliest → < 1780167118 1780167118
Red Hat multicluster global hub 1.4.2 1779579439 earliest → < 1779579439 1779579439
Red Hat multicluster global hub 1.5.1 1778867753 earliest → < 1778867753 1778867753
Multicluster Global Hub 1.5.6 1778867753 earliest → < 1778867753 1778867753
Red Hat multicluster global hub 1.5.3 1778867753 earliest → < 1778867753 1778867753

References

Timeline

  1. Published
  2. Last modified

Other CVEs of nats-server

The 27 CVEs of nats-server →
CVE-2026-58208 NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system 6.8 Medium CVE-2026-58211 NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system 5.4 Medium CVE-2026-58207 NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system 7.7 High CVE-2026-58210 NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system 7.5 High
Track this CVE