CVE Tools
Track your stack

Nats-io

25 CVEs tracked since 2026. Since Mar 2026, none of them reached CISA KEV.

Nats-io CVEs per month

Mar 2026 to Jul 2026. Point at a month, or focus the strip and use the arrow keys.
Nats-io CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2026-03130
2026-04null or fewer
2026-05null or fewer
2026-06null or fewer
2026-07120

Products

The products that kept showing up in Nats-io's monthly top three, with their CVEs summed over those months.

  1. Nats-server252 months

Latest CVEs

The 15 most recently published vulnerabilities affecting Nats-io.

  1. CVE-2026-58208NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled6.8
  2. CVE-2026-58211NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions5.4
  3. CVE-2026-58207NATS Server: Remote crash via integer overflow in Connz pagination7.7
  4. CVE-2026-58210NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory7.5
  5. CVE-2026-58209NATS Server: MQTT retained and QoS replay bypass subscribe deny filters4.3
  6. CVE-2026-58214NATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217)4.3
  7. CVE-2026-58254NATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission check6.5
  8. CVE-2026-58213NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection7.1
  9. CVE-2026-58250NATS Server: Pre-auth server crash via double INFO in leafnode handshake7.5
  10. CVE-2026-58252NATS Server: Subscribe Authz Bypass via Wildcard-Overlap6.5
  11. CVE-2026-58253NATS Server: Route API Auth Bypass8.8
  12. CVE-2026-58251NATS Server: Queue Subscribe Authz Bypass6.5
  13. CVE-2026-33249NATS: Message tracing can be redirected to arbitrary subject4.3
  14. CVE-2026-33223NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing6.4
  15. CVE-2026-33248NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching4.2

The record

Peak rank
#90 in Mar 2026
Busiest month shown
Mar 2026, 13 CVEs
Months with a KEV entry
0 since Mar 2026
Monthly snapshots
2 since 2026
Nats-io's full record, month by month

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store