Nixpkgs security tracker
Untriaged
Permalink
CVE-2026-33249
4.3 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): LOW
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): NONE
- Integrity impact (I): LOW
- Availability impact (A): NONE
NATS: Message tracing can be redirected to arbitrary subject
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission. The payload is a valid trace message and not chosen by the attacker. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
References
-
https://github.com/nats-io/nats-server/security/advisories/GHSA-8m2x-3m6q-6w8j x_refsource_CONFIRM
-
https://advisories.nats.io/CVE/secnote-2026-15.txt x_refsource_MISC
Affected products
nats-server
- ==>= 2.11.0, < 2.11.15
- ==>= 2.12.0-preview.1, < 2.12.6
Package maintainers
-
@derekcollison Derek Collison <derek@nats.io>
-
@swdunlop Scott W. Dunlop <swdunlop@gmail.com>