Read the docs
TI-2026-23371 Aliases CVE-2026-29785GHSA-52jh-2xxh-pwh6

NATS Server panic via malicious compression on leafnode port

Priority MEDIUM 40CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-476.

Summary

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.14 and 2.12.5, if the nats-server has the "leafnode" configuration enabled (not default), then anyone who can connect can crash the nats-server by triggering a panic. This happens pre-authentication and requires that compression be enabled (which it is, by default, when leafnodes are used). Versions 2.11.14 and 2.12.5 contain a fix. As a workaround, disable compression on the leafnode port.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00684 52nd percentileScored 2026-11-07
Fix Fixed nats-server (nats-io): 2.11.14, 2.12.5github.com/nats-io/nats-server/v2 (Go): 2.11.14, 2.12.5Red Hat: 3 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstagenats-serverbefore 2.11.14; 2.12.0-RC.1 to before 2.12.52.11.14, 2.12.5Patch availableCNA
—github.com/nats-io/nats-server/v2 (Go)before 2.11.142.11.14Patch availableGHSA-52jh-2xxh-pwh6
—github.com/nats-io/nats-server/v2 (Go)2.12.0-RC.1 to before 2.12.52.12.5Patch availableGHSA-52jh-2xxh-pwh6
—github.com/nats-io/nats-server (Go)all versions—No fix listedGHSA-52jh-2xxh-pwh6
  • nats-server Vendorbackstage Affected before 2.11.14; 2.12.0-RC.1 to before 2.12.5 Fixed in 2.11.14, 2.12.5 Patch available CNA
  • github.com/nats-io/nats-server/v2 (Go) Vendor— Affected before 2.11.14 Fixed in 2.11.14 Patch available GHSA-52jh-2xxh-pwh6
  • github.com/nats-io/nats-server/v2 (Go) Vendor— Affected 2.12.0-RC.1 to before 2.12.5 Fixed in 2.12.5 Patch available GHSA-52jh-2xxh-pwh6
  • github.com/nats-io/nats-server (Go) Vendor— Affected all versions Fixed in — No fix listed GHSA-52jh-2xxh-pwh6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*before 2.11.14; 2.12.0 to before 2.12.5Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:* Versions before 2.11.14; 2.12.0 to before 2.12.5 Vulnerable ·backstage

Remediation

  • Fix · CNA nats-server (nats-io) Fixed in 2.11.14, 2.12.5
  • Fix · GHSA-52jh-2xxh-pwh6 github.com/nats-io/nats-server/v2 (Go) Fixed in 2.11.14 Advisory →
  • Fix · GHSA-52jh-2xxh-pwh6 github.com/nats-io/nats-server/v2 (Go) Fixed in 2.12.5 Advisory →

Red Hat 3 advisories

  • RHSA-2026:23345 Released 2026-06-04 · Red Hat rating Important
    Multicluster Global Hub 1.6.2 security update
    • Multicluster Global Hub 1.6.6 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:22347 Released 2026-06-01 · Red Hat rating Important
    Multicluster Global Hub 1.4.5 security update
    • Multicluster Global Hub 1.4.9 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:21769 Released 2026-05-28 · Red Hat rating Important
    Multicluster Global Hub 1.5.4 security update
    • Multicluster Global Hub 1.5.8 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Multicluster Global Hub 1.4.9Fixed RHSA-2026:22347
Multicluster Global Hub 1.6.5Fixed RHSA-2026:23345
Red Hat multicluster global hub 1.5.3Fixed RHSA-2026:21769
Not affected: 4 products
  • Multicluster Global Hub 1.4.9
  • Multicluster Global Hub 1.6.5
  • Red Hat OpenShift Container Platform 4
  • Red Hat multicluster global hub 1.5.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-29785
  2. 2026-10-03 Alias added: GHSA-52jh-2xxh-pwh6

References

Patch 1

Advisory 3

Other 1

  • TI-2026-22233 NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead CVSS 3.1HIGH 7.5
  • TI-2022-11116 NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended… CVSS 3.1CRITICAL 9.8
  • TI-2020-16319 The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of… CVSS 3.1CRITICAL 9.8
  • TI-2026-25637 NATS has MQTT plaintext password disclosure CVSS 3.1HIGH 8.6
  • TI-2022-08320 NATS nats-server before 2.7.2 has Incorrect Access Control. CVSS 3.1HIGH 8.8
  • TI-2026-41950 NATS Server: Pre-auth server crash via double INFO in leafnode handshake CVSS 3.1HIGH 7.5
See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences