CVE-2026-33218

HighCVSS 7.5/10Last modified Sep 9, 2026

Description

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-authentication. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, disable leafnode support if not needed or restrict network connections to the leafnode port, if plausible without compromising the service offered.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20 CWE-1286

Affected software

Vendor	Product	Versions
nats-io	nats-server	< < 2.11.15; >= 2.12.0-RC.1, < 2.12.6
Red Hat	Multicluster Global Hub 1.4.5	—
Red Hat	Multicluster Global Hub 1.6.5	—
Red Hat	Red Hat multicluster global hub 1.5.3	—
Red Hat	Red Hat OpenShift Container Platform 4	—

References

Timeline

Published: Mar 25, 2026
Last modified: Sep 9, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-332195.3NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a mali CVE-2026-33225.6Due to improper permission checks in Lobster_pro, attackers are able to interact with endpoints that should require administrative privilege CVE-2026-332206.8Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn CVE-2026-332215.3Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.12.0, the storage service's file upload handler trusts the cli CVE-2026-332224.9NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, users CVE-2026-332235.4NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, the NA CVE-2026-332268.7Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions from 3.30.6 and prior, the REST dataso CVE-2026-332274.3Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache Acti CVE-2026-332289.8flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from th CVE-2026-332299.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.4.8 and 17.10.1, an imp CVE-2026-33237.5An unsecured configuration interface on affected devices allows unauthenticated remote attackers to access sensitive information, including CVE-2026-332306.1NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Na