Bitnami package
nats
pkg:bitnami/nats
Vulnerabilities (29)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-27889 | Hig | 7.5 | >= 2.2.0, < 2.11.14 | 2.11.14 | Mar 25, 2026 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.2.0 and prior to versions 2.11.14 and 2.12.5, a missing sanity check on a WebSockets frame could trigger a server panic in the nats-server. This happens before a | |
| CVE-2026-33215 | Med | 6.5 | < 2.11.15 | 2.11.15 | Mar 24, 2026 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12 | |
| CVE-2026-27571 | Med | 5.9 | < 2.11.12 | 2.11.12 | Feb 24, 2026 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling of NATS messages handles compressed messages via the WebSockets negotiated compression. Prior to versions 2.11.2 and 2.12.3, the implementation bound the memory | |
| CVE-2025-30215 | Cri | 9.6 | >= 2.2.0, < 2.11.1 | 2.11.1 | Apr 16, 2025 | NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting from 2.2.0 but prior to 2.10.27 and 2.11.1, the management of JetStream assets happens with messages in the $JS. subject namespace in the system account; this is | |
| CVE-2023-46129 | Hig | 7.5 | >= 2.10.0, < 2.10.4 | 2.10.4 | Oct 31, 2023 | NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is us | |
| CVE-2022-26652 | Med | 6.5 | >= 2.2.0, < 2.7.4 | 2.7.4 | Mar 10, 2022 | NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams. nats-streaming-server before 0.24.3 is also affected. | |
| CVE-2022-24450 | Hig | 8.8 | >= 2.0.0, < 2.7.2 | 2.7.2 | Feb 8, 2022 | NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically provisioned sandbox accounts" feature. | |
| CVE-2021-3127 | Hig | 7.5 | >= 2.0.0, < 2.2.0 | 2.2.0 | Mar 16, 2021 | NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled. | |
| CVE-2020-28466 | Hig | 7.5 | >= 2.0.0, < 2.2.0 | 2.2.0 | Mar 7, 2021 | This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users pre |
- affected >= 2.2.0, < 2.11.14fixed 2.11.14
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.2.0 and prior to versions 2.11.14 and 2.12.5, a missing sanity check on a WebSockets frame could trigger a server panic in the nats-server. This happens before a
- affected < 2.11.15fixed 2.11.15
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12
- affected < 2.11.12fixed 2.11.12
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling of NATS messages handles compressed messages via the WebSockets negotiated compression. Prior to versions 2.11.2 and 2.12.3, the implementation bound the memory
- affected >= 2.2.0, < 2.11.1fixed 2.11.1
NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting from 2.2.0 but prior to 2.10.27 and 2.11.1, the management of JetStream assets happens with messages in the $JS. subject namespace in the system account; this is
- affected >= 2.10.0, < 2.10.4fixed 2.10.4
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is us
- affected >= 2.2.0, < 2.7.4fixed 2.7.4
NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams. nats-streaming-server before 0.24.3 is also affected.
- affected >= 2.0.0, < 2.7.2fixed 2.7.2
NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically provisioned sandbox accounts" feature.
- affected >= 2.0.0, < 2.2.0fixed 2.2.0
NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled.
- affected >= 2.0.0, < 2.2.0fixed 2.2.0
This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users pre
Page 2 of 2