CVE-2026-33218

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33218
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-33218.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-33218
Aliases
Downstream
CGA (58)
CLEANSTART (1)
DEBIAN (1)
JLSEC (1)
MINI (7)
openSUSE (1)
ROOT (1)
SUSE (1)
UBUNTU (1)
Related
Published
2026-03-25T19:53:12Z
Modified
2026-08-03T02:13:01Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
NATS has pre-auth server panic via leafnode handling
Details

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-authentication. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, disable leafnode support if not needed or restrict network connections to the leafnode port, if plausible without compromising the service offered.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-20"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33218.json"
}
References

Affected packages

Git / github.com/nats-io/nats-server

Affected ranges

Type
GIT
Repo
https://github.com/nats-io/nats-server
Events
Introduced
4dccf778573cd9a9e52fb8f119718459f6f2f761
Fixed
0e0639058e0d2d8fce0cc34941f9897da152ab32
Introduced
bef17e1d9de6574fae0eabe1798db0d4529834e4
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "2.12.0-RC.1"
        },
        {
            "fixed":  "2.12.6"
        },
        {
            "introduced":  "< < 2.11.15"
        },
        {
            "last_affected":  "< < 2.11.15"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

< < 2.*
< < 2.11.15
v2.*
v2.12.0
v2.12.0-RC.1
v2.12.0-RC.2
v2.12.0-RC.3
v2.12.0-RC.4
v2.12.0-RC.5
v2.12.0-RC.6
v2.12.1
v2.12.1-RC.1
v2.12.1-RC.2
v2.12.1-RC.3
v2.12.1-RC.4
v2.12.1-RC.5
v2.12.2
v2.12.2-RC.1
v2.12.2-RC.2
v2.12.2-RC.3
v2.12.2-RC.4
v2.12.3
v2.12.3-RC.1
v2.12.3-RC.2
v2.12.3-RC.3
v2.12.3-RC.4
v2.12.3-RC.5
v2.12.4
v2.12.4-RC.1
v2.12.4-RC.2
v2.12.4-RC.3
v2.12.4-RC.4
v2.12.4-RC.5
v2.12.4-RC.6
v2.12.5
v2.12.5-RC.1
v2.12.5-RC.2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-33218.json"