CVE-2026-33223

NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing

CVSS 3.1 6.4 MEDIUMEUVD CVSS 3.1 6.4 CVSS 3.1 · [email protected] · Secondary 6.4 MEDIUMCVSS 3.1 · [email protected] · Primary 5.4 MEDIUMCVSS_V3 Publisher rating MODERATEFixed by github.com/nats-io/nats-server/v2 2.11.15 Fixed by github.com/nats-io/nats-server/v2 2.12.6osv · severity unknownFixed by github.com/nats-io/nats-server/v2 2.11.15 Fixed by github.com/nats-io/nats-server/v2 2.12.6KEV status unknown

Original advisory

cve-program · CVE-2026-33223

Published

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, the NATS message header `Nats-Request-Info:` is supposed to be a guarantee of identity by the NATS server, but the stripping of this header from inbound messages was not fully effective. An attacker with valid credentials for any regular client interface could thus spoof their identity to services which rely upon this header. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.

Read the publisher's advisory

euvd · EUVD-2026-15996

Published

Read the publisher's advisory

nvd · CVE-2026-33223

Published

Read the publisher's advisory

osv · GHSA-pwx7-fx9r-hr4h

Published

### Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The nats-server offers a `Nats-Request-Info:` message header, providing information about a request. ### Problem Description The NATS message header `Nats-Request-Info:` is supposed to be a guarantee of identity by the NATS server, but the stripping of this header from inbound messages was not fully effective. An attacker with valid credentials for any regular client interface could thus spoof their identity to services which rely upon this header. ### Affected Versions Any version before v2.12.6 or v2.11.15 ### Workarounds None.

Read the publisher's advisory

osv · GO-2026-4835

Published

NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-33223

Published

nats-server

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "nats-io",
                    "product": "nats-server",
                    "versions": [
                        {
                            "version": "< 2.11.15",
                            "status": "affected"
                        },
                        {
                            "version": ">= 2.12.0-RC.1, < 2.12.6",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-15996

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Mar 25, 2026, 8:20:00 PM

dateUpdated: Mar 26, 2026, 5:51:23 PM

1 related source bulletins · separate from aliases

WID-SEC-W-2026-0858: NATS Server: Mehrere Schwachstellen

CVE-2026-33215 · CVE-2026-33216 · CVE-2026-33217 · CVE-2026-33218 · CVE-2026-33219 · CVE-2026-33222 · CVE-2026-33223 · CVE-2026-33246 · CVE-2026-33247 · CVE-2026-33248 · CVE-2026-33249

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2026-33223

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Analyzed

Weakness classifications: CWE-290

Original publisher date fields

published: 2026-03-25T21:16:47.397

lastModified: 2026-06-17T10:37:09.117

1 source CPE criteria · context only

cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-pwx7-fx9r-hr4h

Published

github.com/nats-io/nats-server/v2

SEMVER · introduced 0 → fixed 2.11.15

github.com/nats-io/nats-server/v2

SEMVER · introduced 2.12.0-RC.1 → fixed 2.12.6

github.com/nats-io/nats-server

SEMVER · introduced 0

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GO-2026-4835

Published

github.com/nats-io/nats-server

SEMVER · introduced 0

github.com/nats-io/nats-server/v2

SEMVER · introduced 0 → fixed 2.11.15 → introduced 2.12.0-RC.1 → fixed 2.12.6

Original source record · Cite this exact observation · Complete original publisher JSON