CVE-2026-29785
HIGHSeverity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (https://github.com/nats-io/nats-server).
CVSS VectorVendor: https://github.com/nats-io/nats-server
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionCVE.org
Background
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.
When configured to accept leafnode connections (for a hub/spoke topology of multiple nats-servers), then the default configuration allows for negotiating compression; a malicious remote NATS server can trigger a server panic via that compression.
Problem Description
If the nats-server has the "leafnode" configuration enabled (not default), then anyone who can connect can crash the nats-server by triggering a panic. This happens pre-authentication and requires that compression be enabled (which it is, by default, when leafnodes are used).
Context: a NATS server can form various clustering topologies, including local clusters, and superclusters of clusters, but leafnodes allow for separate administrative domains to link together with limited data communication; eg, a server in a moving vehicle might use a local leafnode for agents to connect to, and sync up to a central service as and when available. The leafnode configuration here is where the central server allows other NATS servers to connect into it, almost like regular NATS clients. Documentation examples typically use port 7422 for leafnode communications.
Affected Versions
Version 2, prior to v2.11.14 or v2.12.5
Workarounds
Disable compression on the leafnode port:
leafnodes {
port: 7422
compression: off
}AnalysisAI
NATS server with leafnode clustering enabled is vulnerable to a denial-of-service crash triggered by remote attackers who exploit null pointer dereference in the compression negotiation handler prior to authentication. Any attacker capable of connecting to a leafnode-configured NATS server can trigger a server panic, causing service disruption. A patch is available to remediate this high-severity vulnerability.
Technical ContextAI
NATS.io is a high-performance pub-sub distributed communication technology designed for cloud, on-premise, IoT, and edge computing environments. Leafnodes enable hub-and-spoke topologies where separate administrative domains can link together, typically listening on port 7422, allowing remote NATS servers to connect for limited data communication across trust boundaries. The vulnerability is rooted in CWE-476 (NULL Pointer Dereference) within the compression negotiation mechanism during leafnode connection establishment. The affected products are identified via CPE as pkg:go/github.com_nats-io_nats-server_v2, indicating Go-based implementations of the NATS server version 2 series. The flaw occurs during the compression negotiation phase before authentication completes, meaning the server processes potentially malicious compression data without verifying the connecting entity's identity.
RemediationAI
Upgrade NATS server to version 2.11.14 or later for version 2.11.x deployments, or version 2.12.5 or later for version 2.12.x deployments. The patch commit is available at https://github.com/nats-io/nats-server/commit/a1488de6f2ba6e666aef0f9cce0016f7f167d6a8. As an immediate workaround until patching is possible, disable compression on the leafnode port by adding 'compression: off' within the leafnodes configuration block. Additionally, restrict network access to the leafnode port (typically 7422) to only trusted NATS servers using firewall rules or network segmentation. Refer to the vendor security advisory at https://github.com/nats-io/nats-server/security/advisories/GHSA-52jh-2xxh-pwh6 for complete remediation guidance and https://advisories.nats.io/CVE/secnote-2026-04.txt for additional security notes.
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today