CVE-2026-29785 NATS Server panic via malicious compression on leafnode port
An attacker can crash the NATS server by sending malicious compressed data to the leafnode port, requiring leafnode configuration to be enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-29785?
CVE-2026-29785 is a high-severity denial of service vulnerability in nats-io nats-server, published on 25 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.14 and 2.12.5, if the nats-server has the "leafnode" configuration enabled (not default), then anyone who can connect can crash the nats-server by triggering a panic. This happens pre-authentication and requires that compression be enabled (which it is, by default, when leafnodes are used). Versions 2.11.14 and 2.12.5 contain a fix. As a workaround, disable compression on the leafnode port.
Which versions are affected by CVE-2026-29785?
9 open source packages ship an affected version, including github.com/nats-io/nats-server/v2, nats and github.com/nats-io/nats-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/nats-io/nats-server/v2 Go | All versions | 2.11.14, 2.12.5 |
github.com/nats-io/nats-server/v2 Go | All versions | 2.11.14 |
github.com/nats-io/nats-server/v2 Go | All versions | 2.11.14 |
github.com/nats-io/nats-server/v2 Go | From 2.12.0-RC.1 | 2.12.5 |
github.com/nats-io/nats-server/v2 Go | From 2.12.0-RC.1 | 2.12.5 |
nats Bitnami | All versions | 2.11.14, 2.12.5 |
3 more packages
github.com/nats-io/nats-server Go | All versions | None |
github.com/nats-io/nats-server Go | All versions | None |
github.com/nats-io/nats-server Go | All versions | None |
Products include Linuxfoundation Nats-Server.
How do I fix CVE-2026-29785?
Upgrade github.com/nats-io/nats-server/v2 to a fixed version for your release line: 2.11.14 or 2.12.5.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-29785 being exploited?
There is no known exploitation of CVE-2026-29785 in the wild and no public exploit code.
Other vulnerabilities in nats-io nats-server
- CVE-2022-28357 NATS nats-server allows directory traversal via unintended path to a management action
- CVE-2026-58253 NATS Server: Route API Auth Bypass
- CVE-2022-24450 Incorrect Authorization in NATS nats-server
- CVE-2026-33216 NATS has MQTT plaintext password disclosure
- CVE-2026-58207 NATS Server: Remote crash via integer overflow in Connz pagination
Sources
Also known as AZL-81642, BIT-nats-2026-29785, DEBIAN-CVE-2026-29785, ECHO-51b8-a3f3-a502, GHSA-52jh-2xxh-pwh6, GO-2026-4829 and 10 more.