NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an unauthenticated peer to bypass inter-server CONNECT authentication and operate with the privileges associated with that connection type. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16.
Fix
Patch, vendor advisory and mitigation references on NVD 4
- https://github.com/nats-io/nats-server/commit/7b81dd455ea95960090a84858c7662827948d1b6 Patch
- https://github.com/nats-io/nats-server/commit/8b8e1ad4ceed32321e00d4fc6e76be05bc13bca6 Patch
- https://github.com/nats-io/nats-server/commit/b86147e81710a52b72a7f7275f91d69f723f5cb3 Patch
- https://github.com/nats-io/nats-server/security/advisories/GHSA-38x3-76xf-cq45 Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.8 · linuxfoundationNVD modified 2026-10-25 17:10
Affected (CPE criteria) 1
cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*
References 7
- https://github.com/nats-io/nats-server/commit/7b81dd455ea95960090a84858c7662827948d1b6 Patch
- https://github.com/nats-io/nats-server/commit/8b8e1ad4ceed32321e00d4fc6e76be05bc13bca6 Patch
- https://github.com/nats-io/nats-server/commit/b86147e81710a52b72a7f7275f91d69f723f5cb3 Patch
- https://github.com/nats-io/nats-server/releases/tag/v2.11.16 Release Notes
- https://github.com/nats-io/nats-server/releases/tag/v2.12.7 Release Notes
- https://github.com/nats-io/nats-server/releases/tag/v2.14.0 Release Notes
- https://github.com/nats-io/nats-server/security/advisories/GHSA-38x3-76xf-cq45 Vendor Advisory