GHSA-fcjp-h8cc-6879

Source

https://github.com/advisories/GHSA-fcjp-h8cc-6879

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-fcjp-h8cc-6879/GHSA-fcjp-h8cc-6879.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-fcjp-h8cc-6879

Aliases

Downstream

CGA (58)

MINI (7)

Published

2026-03-24T21:39:52Z

Modified

2026-07-17T21:09:24Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L CVSS Calculator

Summary

NATS is vulnerable to MQTT hijacking via Client ID

Details

Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The nats-server provides an MQTT client interface.

Problem Description

Sessions and Messages can by hijacked via MQTT Client ID malfeasance.

Affected Versions

Any version before v2.12.6 or v2.11.15

Workarounds

None.

Resources

This document is canonically: https://advisories.nats.io/CVE/secnote-2026-06.txt
GHSA advisory: https://github.com/nats-io/nats-server/security/advisories/GHSA-fcjp-h8cc-6879
MITRE CVE entry: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33215

Database specific

{
    "cwe_ids": [
        "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-24T21:39:52Z",
    "nvd_published_at": "2026-03-24T21:16:28Z",
    "severity": "MODERATE"
}

References

Affected packages

Go / github.com/nats-io/nats-server/v2

Package

Name: github.com/nats-io/nats-server/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/nats-io/nats-server/v2

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.11.15

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-fcjp-h8cc-6879/GHSA-fcjp-h8cc-6879.json"

Go / github.com/nats-io/nats-server/v2

Package

Name: github.com/nats-io/nats-server/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/nats-io/nats-server/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.12.0-RC.1

Fixed

2.12.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-fcjp-h8cc-6879/GHSA-fcjp-h8cc-6879.json"