nats-server
v2.15.3High-Performance server for NATS.io, the cloud and edge native messaging system.
- Maintenance
- Active666 commits in 3 months · bus factor 2
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 30 advisories3 critical, 18 high, 9 medium · Scorecard 7.6/10
- Supported versions
- No scheduleendoflife.date does not track this project
21k stars · 2k forks · 475 open issues · last release 4 days ago · data checked 4 hours ago
Security advisories
All advisories on GitHubThe 30 most recent advisories published by the maintainers: 3 critical, 18 high, 9 medium. Check the patched version against the one you run.
- highGHSA-p849-62j6-rhc5Nov 13, 2026Leafnode connections can corrupt shared user permissions
- Affected
- <= 2.14.9, <= 2.15.2
- Patched in
- 2.14.10, 2.15.3
- highGHSA-vqv6-8g5v-c9c4Nov 12, 2026Client-supplied identity fields can bypass authorization callouts
- Affected
- <= 2.14.7, <= 2.15.0
- Patched in
- 2.14.8, 2.15.1
- mediumGHSA-rr37-7hx9-8xw5Nov 12, 2026Memory-backed stream purges can cause excessive CPU use
- Affected
- <= 2.14.9, <= 2.15.2
- Patched in
- 2.14.10, 2.15.3
- highGHSA-r9gv-x84w-62mrNov 12, 2026Leafnode peers can forge JetStream acknowledgements outside their permissions
- Affected
- <= 2.14.9, <= 2.15.1
- Patched in
- 2.14.10, 2.15.2
- criticalGHSA-q57r-qh7g-9wgmNov 12, 2026Certificate-mapped identities can authenticate by password on another listener
- Affected
- <= 2.12.13, <= 2.14.3
- Patched in
- 2.12.14, 2.14.4, 2.15.0
- mediumGHSA-p8x9-xrv7-3g8jNov 12, 2026JetStream restore format detection can buffer excessive data
- Affected
- <= 2.15.0
- Patched in
- 2.15.1
- highGHSA-p29q-ccgc-hcg7Nov 12, 2026Authorization callouts did not enforce JWT source restrictions
- Affected
- <= 2.14.9, <= 2.15.2
- Patched in
- 2.14.10, 2.15.3
- mediumGHSA-mf72-w5mg-h2mgNov 12, 2026Removing TLS certificate pins does not revoke existing client connections
- Affected
- <= 2.14.7, <= 2.15.0
- Patched in
- 2.14.8, 2.15.1
- mediumGHSA-m996-6cph-cjhcNov 12, 2026MQTT internal subscriptions can bypass topic deny rules
- Affected
- <= 2.12.13, <= 2.14.3
- Patched in
- 2.12.14, 2.14.4, 2.15.0
- highGHSA-hwrp-2926-g93mNov 12, 2026Malformed MQTT and counter records can terminate the server
- Affected
- <= 2.12.13, <= 2.14.3
- Patched in
- 2.12.14, 2.14.4, 2.15.0
- mediumGHSA-hm5m-vqj5-vf2qNov 12, 2026Unexpected MQTT acknowledgements can consume JetStream storage
- Affected
- <= 2.15.0
- Patched in
- 2.15.1
- mediumGHSA-h9r4-8j36-3c2fNov 12, 2026Malformed JWT permission subjects can terminate the server
- Affected
- <= 2.12.13, <= 2.14.3
- Patched in
- 2.12.14, 2.14.4, 2.15.0
- highGHSA-gc58-jp35-x246Nov 12, 2026Leafnode permissions can be bypassed for internal MQTT subjects
- Affected
- <= 2.14.8, <= 2.15.1
- Patched in
- 2.14.9, 2.15.2
- criticalGHSA-g9p6-654w-mr9vNov 12, 2026Pre-CONNECT no_auth_user handling can bypass authorization callouts
- Affected
- <= 2.12.13, <= 2.14.3
- Patched in
- 2.12.14, 2.14.4, 2.15.0
- highGHSA-fwrx-9r9q-h7p4Nov 12, 2026Leafnode peers can bypass publish permissions for JetStream acknowledgements
- Affected
- <= 2.14.9, <= 2.15.2
- Patched in
- 2.14.10, 2.15.3
- highGHSA-c5hj-fqj4-pj32Nov 12, 2026MQTT packet buffering can cause memory and CPU exhaustion
- Affected
- <= 2.14.7, <= 2.15.0
- Patched in
- 2.14.8, 2.15.1
- highGHSA-9qgw-9q78-p7xvNov 12, 2026Queue-scoped deny permissions were inconsistently enforced
- Affected
- <= 2.12.13, <= 2.14.3
- Patched in
- 2.12.14, 2.14.4, 2.15.0
- criticalGHSA-8xmc-886f-g496Nov 12, 2026MQTT listener OCSP peer verification can be silently omitted
- Affected
- <= 2.14.8, <= 2.15.1
- Patched in
- 2.14.9, 2.15.2
- highGHSA-8fcg-2fq8-c8qcNov 12, 2026Oversized MQTT subscription packets can exhaust server resources
- Affected
- <= 2.14.7, <= 2.15.0
- Patched in
- 2.14.8, 2.15.1
- highGHSA-7mrx-vpq7-fhmpNov 12, 2026Ordinary users in an authorization account can receive callout requests
- Affected
- <= 2.14.9, <= 2.15.2
- Patched in
- 2.14.10, 2.15.3
- highGHSA-72gq-694q-fj66Nov 12, 2026Connected MQTT clients can bypass packet buffering limits
- Affected
- <= 2.14.7, <= 2.15.0
- Patched in
- 2.14.8, 2.15.1
- highGHSA-724w-jvcm-4c58Nov 12, 2026Authorization callouts did not enforce allowed connection types
- Affected
- <= 2.14.8, <= 2.15.1
- Patched in
- 2.14.9, 2.15.2
- highGHSA-65q4-982r-rm5cNov 12, 2026OCSP responses were not bound to the certificate being checked
- Affected
- <= 2.14.8, <= 2.15.1
- Patched in
- 2.14.9, 2.15.2
- mediumGHSA-5xw9-67vx-qpprNov 12, 2026Invalid snapshot delivery subjects can leak server resources
- Affected
- <= 2.12.13, <= 2.14.3
- Patched in
- 2.12.14, 2.14.4, 2.15.0
- highGHSA-5v9x-4f9q-q7qjNov 12, 2026Remote queue subscription weights can exhaust server memory
- Affected
- <= 2.14.8, <= 2.15.1
- Patched in
- 2.14.9, 2.15.2
- highGHSA-5qvj-hvwx-q9qfNov 12, 2026Route and cluster URL credentials can be exposed by debug endpoints
- Affected
- <= 2.12.7, < 2.14.0, < 2.15.0
- Patched in
- 2.12.8, 2.14.0, 2.15.0
- highGHSA-4fpp-8grw-j976Nov 12, 2026Route pool index panic
- Affected
- <= 2.14.9, <= 2.15.2
- Patched in
- 2.14.10, 2.15.3
- mediumGHSA-42wr-c22f-4h5cNov 12, 2026HTTPS leafnode proxies can receive credentials without TLS
- Affected
- <= 2.14.7, <= 2.15.0
- Patched in
- 2.14.8, 2.15.1
- highGHSA-2wxw-wgx7-4ffxNov 12, 2026Scoped signing key templates can bypass required proxy authentication
- Affected
- <= 2.14.7, <= 2.15.0
- Patched in
- 2.14.8, 2.15.1
- mediumGHSA-27c4-m7hq-v6pwNov 12, 2026Remote queue subscription weights can exhaust server memory
- Affected
- <= 2.14.8, <= 2.15.1
- Patched in
- 2.14.9, 2.15.2