NATS has pre-auth server panic via leafnode handling

高 7.5CVE-2026-33218 · BIT-nats-2026-33218 · GHSA-vprv-35vv-q339 · 25/03/2026 公開 · 09/09/2026 更新

要点

CVE-2026-33218 は github.com/nats-io/nats-server, github.com/nats-io/nats-server/v2, nats-server (linuxfoundation) に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.63%（全脆弱性の 50.1% より高い）。
対処：2.12.6, 2.11.15 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/nats-io/nats-server Go	`全バージョン`	修正版なし
github.com/nats-io/nats-server/v2 Go	`≥ 2.12.0-RC.1, < 2.12.6< 2.11.15`	`2.12.62.11.15`
nats-server linuxfoundation	`≥ 2.12.0, < 2.12.6< 2.11.15`	`2.12.62.11.15`

概要

Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The nats-server allows hub/spoke topologies using "leafnode" connections by other nats-servers.

Problem Description

A client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-authentication.

Affected Versions

Any version before v2.12.6 or v2.11.15

Workarounds

Disable leafnode support if not needed.
Restrict network connections to your leafnode port, if plausible without compromising the service offered.

References

This document is canonically: https://advisories.nats.io/CVE/secnote-2026-10.txt
GHSA advisory: https://github.com/nats-io/nats-server/security/advisories/GHSA-vprv-35vv-q339
MITRE CVE entry: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33218

NVD の説明

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-authentication. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, disable leafnode support if not needed or restrict network connections to the leafnode port, if plausible without compromising the service offered.