NATS Server Vulnerabilities Allow Remote Attackers to Disclose/Manipulate Info, Cause DoS

CERT-Bund has released security advisory WID-SEC-2026-0858 detailing critical vulnerabilities in Open Source NATS Server versions prior to 2.12.6 and 2.11.15. The advisory highlights a CVSS base score of 8.6, indicating a high severity. Remote, anonymous attackers can exploit these flaws to disclose or manipulate information, cause denial-of-service (DoS) conditions, and bypass security controls.

Organizations utilizing affected NATS Server versions, particularly those running on Linux and UNIX operating systems, should prioritize applying the available mitigations. This involves updating to NATS Server version 2.12.6 or later, or 2.11.15 or later, to address these security risks. Failure to do so could lead to significant information breaches, service disruptions, and compromised security posture.