Vulnerability Details CVE-2026-33218
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-authentication. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, disable leafnode support if not needed or restrict network connections to the leafnode port, if plausible without compromising the service offered.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.006
EPSS Ranking 45.0%
CVSS Severity
CVSS v3 Score 7.5
References
- https://advisories.nats.io/CVE/secnote-2026-10.txt
- https://github.com/nats-io/nats-server/security/advisories/GHSA-vprv-35vv-q339
- https://access.redhat.com/errata/RHSA-2026:21769
- https://access.redhat.com/errata/RHSA-2026:22347
- https://access.redhat.com/errata/RHSA-2026:23345
- https://access.redhat.com/security/cve/CVE-2026-33218
- https://bugzilla.redhat.com/show_bug.cgi?id=2451450
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33218.json
Products affected by CVE-2026-33218
-
cpe:2.3:a:linuxfoundation:nats-server:2.12.0
-
cpe:2.3:a:linuxfoundation:nats-server:2.12.1
-
cpe:2.3:a:linuxfoundation:nats-server:2.12.2
-
cpe:2.3:a:linuxfoundation:nats-server:2.12.3
-
cpe:2.3:a:linuxfoundation:nats-server:2.12.4
-
cpe:2.3:a:linuxfoundation:nats-server:2.12.5