Vulnerabilidades en nats-io

28 resultados
Análisis Vexday

O NATS.io acumula 28 vulnerabilidades catalogadas, com concentração recente: 12 divulgadas nos últimos 90 dias. Embora nenhuma esteja sob exploração ativa documentada no KEV, há uma vulnerabilidade crítica na base e a fraqueza dominante (CWE-863: verificação inadequada de autorização) indica risco de elevação de privilégio. O volume recente de publicações sugere que a superfície de risco está em movimento.

CVE-2026-29785HIGHNATS Server panic via malicious compression on leafnode portEPSS 0.7%CVE-2026-33218HIGHNATS has pre-auth server panic via leafnode handlingEPSS 0.6%CVE-2025-30215CRITICALNATS-Server Fails to Authorize Certain Jetstream Admin APIsEPSS 0.6%CVE-2026-27889HIGHNATS: Pre-auth remote server crash via WebSocket frame length overflow in wsReadEPSS 0.6%CVE-2026-33219MEDIUMNATS is vulnerable to pre-auth DoS through WebSockets client serviceEPSS 0.5%CVE-2026-58210HIGHNATS Server: MQTT partial CONNECT packets can exhaust pre-auth memoryEPSS 0.5%CVE-2026-58250HIGHNATS Server: Pre-auth server crash via double INFO in leafnode handshakeEPSS 0.5%CVE-2026-27571MEDIUMnats-server websockets are vulnerable to pre-auth memory DoSEPSS 0.5%CVE-2026-33247HIGHNATS credentials are exposed in monitoring port via command-line argvEPSS 0.4%CVE-2026-58207HIGHNATS Server: Remote crash via integer overflow in Connz paginationEPSS 0.4%CVE-2023-46129HIGHxkeys Seal encryption used fixed key for all encryptionEPSS 0.4%CVE-2026-33216HIGHNATS has MQTT plaintext password disclosureEPSS 0.4%CVE-2026-58252MEDIUMNATS Server: Subscribe Authz Bypass via Wildcard-OverlapEPSS 0.3%CVE-2026-58251MEDIUMNATS Server: Queue Subscribe Authz BypassEPSS 0.3%CVE-2026-58208MEDIUMNATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is EnabledEPSS 0.3%CVE-2026-58213HIGHNATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injectionEPSS 0.3%CVE-2026-33222MEDIUMNATS JetStream has an authorization bypass through its Management APIEPSS 0.3%CVE-2026-33217HIGHNATS allows MQTT clients to bypass ACL checksEPSS 0.3%CVE-2026-58214MEDIUMNATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217)EPSS 0.3%CVE-2026-58209MEDIUMNATS Server: MQTT retained and QoS replay bypass subscribe deny filtersEPSS 0.3%