Vulnerability in Linuxfoundation Nats-Server
CVE-2026-33223
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, the NATS message header `Nats-Request-Info:` is supposed to be a guarantee of identity by the NATS server, but the stripping of this header from inbound messages was not fully effective. An attacker with valid credentials for any regular client interface could thus spoof their identity to services which rely upon this header. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.002 (13.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 13th percentile — 13.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: +0.000
Affected products
- Linuxfoundation Nats-Server
- Nats-Io Nats-Server — versions < 2.11.15, >= 2.12.0-RC.1, < 2.12.6
Weakness classification (CWE)
References
- github.com/nats-io/nats-server/security/advisories/GHSA-pwx7-fx9r-hr4h (Vendor Advisory)
- advisories.nats.io/CVE/secnote-2026-09.txt (Vendor Advisory)
Frequently asked questions
- What is CVE-2026-33223?
- CVE-2026-33223 is a medium-severity vulnerability in Linuxfoundation Nats-Server, classified under Authentication Bypass by Spoofing. CVSS score: 6.4/10. Published 2026-03-25.
- How severe is CVE-2026-33223?
- Medium severity. CVSS v3 base score is 6.4 out of 10.