NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user could receive messages on denied subjects when a wildcard subscription overlapped with a configured wildcard deny rule but was not a subset of it, and queue subscriptions could also affect delivery to legitimate queue consumers. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16.
Fix
Patch, vendor advisory and mitigation references on NVD 4
- https://github.com/nats-io/nats-server/commit/8ced85a11497f86704a95d960281480ce037386b Patch
- https://github.com/nats-io/nats-server/commit/a42a6d1e258eb5c3a2190384d31965a4b715e854 Patch
- https://github.com/nats-io/nats-server/commit/e611ca9604697b02d8f22beb76037400a9cf72e6 Patch
- https://github.com/nats-io/nats-server/security/advisories/GHSA-wh7g-5m82-pmhr Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.5 · linuxfoundationNVD modified 2026-10-25 17:10
Affected (CPE criteria) 1
cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*
References 7
- https://github.com/nats-io/nats-server/commit/8ced85a11497f86704a95d960281480ce037386b Patch
- https://github.com/nats-io/nats-server/commit/a42a6d1e258eb5c3a2190384d31965a4b715e854 Patch
- https://github.com/nats-io/nats-server/commit/e611ca9604697b02d8f22beb76037400a9cf72e6 Patch
- https://github.com/nats-io/nats-server/releases/tag/v2.11.16 Release Notes
- https://github.com/nats-io/nats-server/releases/tag/v2.12.7 Release Notes
- https://github.com/nats-io/nats-server/releases/tag/v2.14.0 Release Notes
- https://github.com/nats-io/nats-server/security/advisories/GHSA-wh7g-5m82-pmhr Vendor Advisory