Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

NATS Server fails to block unauthorized message delivery

published 3 months ago
Summary

Old versions of NATS Server allow unauthorized access to certain messages. This can let malicious users receive sensitive information. To fix this, update to version 2.14.3 or 2.12.12 or later.

What to do
  • Update juliabinarywrappers nats_server_jll to version 2.14.3+0.
Affected software
Ecosystem VendorProductAffected versions
Julia juliabinarywrappers nats_server_jll < 2.14.3+0
Fix: upgrade to 2.14.3+0
Original advisory text
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver ...
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured subscribe deny rule because these delivery paths did not consistently recheck the concrete original topic before sending the MQTT PUBLISH to the subscriber. This issue is fixed in versions 2.14.3 and 2.12.12.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.3 Medium
Timeline
Published3 Aug 2026
Updated3 Aug 2026
First seen3 Aug 2026
Sources
JLSEC-2026-1146 · OSV
Track software like this
Free during beta