NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing
cve-program · CVE-2026-33223
PublishedNATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, the NATS message header `Nats-Request-Info:` is supposed to be a guarantee of identity by the NATS server, but the stripping of this header from inbound messages was not fully effective. An attacker with valid credentials for any regular client interface could thus spoof their identity to services which rely upon this header. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
Read the publisher's advisoryeuvd · EUVD-2026-15996
PublishedNATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, the NATS message header `Nats-Request-Info:` is supposed to be a guarantee of identity by the NATS server, but the stripping of this header from inbound messages was not fully effective. An attacker with valid credentials for any regular client interface could thus spoof their identity to services which rely upon this header. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
Read the publisher's advisorynvd · CVE-2026-33223
PublishedNATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, the NATS message header `Nats-Request-Info:` is supposed to be a guarantee of identity by the NATS server, but the stripping of this header from inbound messages was not fully effective. An attacker with valid credentials for any regular client interface could thus spoof their identity to services which rely upon this header. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
Read the publisher's advisoryosv · GHSA-pwx7-fx9r-hr4h
Published### Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The nats-server offers a `Nats-Request-Info:` message header, providing information about a request. ### Problem Description The NATS message header `Nats-Request-Info:` is supposed to be a guarantee of identity by the NATS server, but the stripping of this header from inbound messages was not fully effective. An attacker with valid credentials for any regular client interface could thus spoof their identity to services which rely upon this header. ### Affected Versions Any version before v2.12.6 or v2.11.15 ### Workarounds None.
Read the publisher's advisoryosv · GO-2026-4835
PublishedNATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-33223 · CVE overview and exploitation status
cve-program · CVE-2026-33223
- https://github.com/nats-io/nats-server/security/advisories/GHSA-pwx7-fx9r-hr4h
- https://advisories.nats.io/CVE/secnote-2026-09.txt
euvd · EUVD-2026-15996
- https://github.com/nats-io/nats-server/security/advisories/GHSA-pwx7-fx9r-hr4h
- https://advisories.nats.io/CVE/secnote-2026-09.txt
nvd · CVE-2026-33223
- https://advisories.nats.io/CVE/secnote-2026-09.txt
- https://github.com/nats-io/nats-server/security/advisories/GHSA-pwx7-fx9r-hr4h
osv · GHSA-pwx7-fx9r-hr4h
- https://github.com/nats-io/nats-server/security/advisories/GHSA-pwx7-fx9r-hr4h
- https://nvd.nist.gov/vuln/detail/CVE-2026-33223
- https://advisories.nats.io/CVE/secnote-2026-09.txt
- https://github.com/nats-io/nats-server
osv · GO-2026-4835
Related changes
Linked by CVE identifierNo related changes are available here.