CVE-2026-33218: NATS has pre-auth server panic via leafnode handling
Background
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.
The nats-server allows hub/spoke topologies using "leafnode" connections by other nats-servers.
Problem Description
A client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-authentication.
Affected Versions
Any version before v2.12.6 or v2.11.15
Workarounds
1. Disable leafnode support if not needed. 2. Restrict network connections to your leafnode port, if plausible without compromising the service offered.
References
This document is canonically: <https://advisories.nats.io/CVE/secnote-2026-10.txt> GHSA advisory: <https://github.com/nats-io/nats-server/security/advisories/GHSA-vprv-35vv-q339> MITRE CVE entry: <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33218>
Other sources
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-authentication. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, disable leafnode support if not needed or restrict network connections to the leafnode port, if plausible without compromising the service offered.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/nats-io/nats-server/v2to a version that resolves this vulnerability.Fixed in 2.12.6 - Upgrade
Upgrade
go/github.com/nats-io/nats-server/v2to a version that resolves this vulnerability.Fixed in 2.11.15 - Upgrade
Upgrade
nats-serverto a version that resolves this vulnerability.Fixed in 2.11.15 - Upgrade
Upgrade
nats-serverto a version that resolves this vulnerability.Fixed in 2.12.6 - Configuration
As a workaround, disable leafnode support if it is not needed (affected if running a version before v2.12.6 or v2.11.15).
nats-server (leafnode) leafnode support = disabled - Compensating control
As a workaround, restrict network connections to the nats-server leafnode port, if plausible without compromising the service offered (affected if running a version before v2.12.6 or v2.11.15).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33218?
The severity of CVE-2026-33218 is classified as moderate.
How do I fix CVE-2026-33218?
To fix CVE-2026-33218, upgrade the nats-server to version 2.12.6 or 2.11.15.
What versions of nats-server are affected by CVE-2026-33218?
CVE-2026-33218 affects nats-server versions from 2.12.0-RC.1 up to but not including 2.12.6, and all versions prior to 2.11.15.
What type of vulnerability is CVE-2026-33218?
CVE-2026-33218 is a vulnerability related to insecure connection handling in nats-server.
Who is affected by CVE-2026-33218?
Users of nats-server versions within the specified ranges are affected by CVE-2026-33218.