CVE-2026-33218

Name of the Vulnerable Software and Affected Versions NATS-Server versions prior to 2.11.15 NATS-Server versions prior to 2.12.6

Description NATS-Server is a high-performance server for NATS.io, a cloud and edge native messaging system. A client connected to the leafnode port can crash the server with a specifically crafted, malformed message during pre-authentication. The server supports hub/spoke topologies using leafnode connections from other nats-servers.

Recommendations Versions prior to 2.11.15 should be updated to version 2.11.15 or later. Versions prior to 2.12.6 should be updated to version 2.12.6 or later. If leafnode support is not needed, disable it. Restrict network connections to the leafnode port if possible without impacting service.