How many CVEs have a located fix in nats-io/nats-server?

20 published CVEs have a fix traced to functions in nats-io/nats-server, touching 167 functions across 30 files.

Which function in nats-io/nats-server has been patched by the most CVEs?

canSubscribe in server/client.go has been changed by 3 CVE fixes, from 2026 to 2026.

How large is a typical CVE fix in nats-io/nats-server?

The median fix changes 19 lines. 55% of fixes change 20 lines or fewer, and 30% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

go

#267 of 500 repositories

nats-io/nats-server

Name: nats-io/nats-server: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix July 8, 2026

20

CVE fixes located

Published CVEs

167

Functions patched

Distinct function sites

30

Files patched

Distinct source files

2019–2026

Years covered

By CVE publication date

Overview

20 published CVEs have a fix traced to functions in nats-io/nats-server, the earliest published in 2019. Those fixes changed 167 distinct functions across 30 files, in 389 patch hunks.

Among the 500 repositories tracked here, nats-io/nats-server ranks #267 by the number of CVEs with a located fix.

Most patched functions

Functions in nats-io/nats-server changed by the most CVE fixes.

Most patched files

Files in nats-io/nats-server changed by the most CVE fixes.

1server/client.go5 CVEs · 13 functions
2server/mqtt.go5 CVEs · 10 functions
3server/leafnode.go4 CVEs · 8 functions
4server/accounts.go3 CVEs · 6 functions
5server/server.go3 CVEs · 6 functions
6server/websocket.go3 CVEs · 5 functions
7server/auth.go3 CVEs · 2 functions
8server/jetstream_api.go2 CVEs · 10 functions
9server/monitor.go2 CVEs · 4 functions
10server/util.go2 CVEs · 2 functions

Fix size

How much code a CVE fix in nats-io/nats-server changes, with backports counted once.

19

Median lines changed

Added plus removed, per CVE

55%

Fixes of 20 lines or fewer

Share of CVE fixes

30%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in nats-io/nats-server, and the functions each fix changed.

NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled
CVE-2026-58208wsUpgrade
High · CVSS 7.5
EPSS 0.6%2026-07-08
NATS Server: Remote crash via integer overflow in Connz pagination
CVE-2026-58207Connz Subsz
High · CVSS 7.7
EPSS 0.6%2026-07-08
NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory
CVE-2026-58210readPacketLen mqttParse readPacketLenWithCheck
High · CVSS 7.5
EPSS 0.7%2026-07-08
NATS Server: MQTT retained and QoS replay bypass subscribe deny filters
CVE-2026-58209mqttDeliverMsgCbQoS12 serializeRetainedMsgsForSub
Medium · CVSS 4.3
EPSS 0.3%2026-07-08
NATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217)
CVE-2026-58214HasPrefix
Medium · CVSS 4.3
EPSS 0.3%2026-07-08
NATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission check
CVE-2026-58254allowedToPublishOnMsgTraceDest
Medium · CVSS 5.3
EPSS 0.3%2026-07-08
NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection
CVE-2026-58213wsAllowedFIPS mergeDenyPermissions sendStatszUpdate
High · CVSS 7.1
EPSS 0.4%2026-07-08
NATS Server: Pre-auth server crash via double INFO in leafnode handshake
CVE-2026-58250leafNodeFinishConnectProcess processLeafnodeInfo
High · CVSS 7.5
EPSS 0.7%2026-07-08
NATS Server: Subscribe Authz Bypass via Wildcard-Overlap
CVE-2026-58252canSubscribe
Medium · CVSS 6.5
EPSS 0.5%2026-07-08
NATS Server: Route API Auth Bypass
CVE-2026-58253parse
High · CVSS 8.8
EPSS 0.4%2026-07-08
NATS Server: Queue Subscribe Authz Bypass
CVE-2026-58251canSubscribe
Medium · CVSS 6.5
EPSS 0.5%2026-07-08
NATS has MQTT plaintext password disclosure
CVE-2026-33216processClientOrLeafAuthentication mqttParseConnect
High · CVSS 8.6
EPSS 0.6%2026-03-25

Get an alert for each new nats-io/nats-server CVE, with the patched functions and AI-written analysis.

Monitor nats-server CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

DCMTK/dcmtk20 CVEs git/git20 CVEs hestiacp/hestiacp20 CVEs jgraph/drawio20 CVEs langgenius/dify20 CVEs michaelrsweet/htmldoc20 CVEs misskey-dev/misskey20 CVEs NousResearch/hermes-agent20 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in nats-io/nats-server.

How many CVEs have a located fix in nats-io/nats-server?: 20 published CVEs have a fix traced to functions in nats-io/nats-server, touching 167 functions across 30 files.
Which function in nats-io/nats-server has been patched by the most CVEs?: canSubscribe in server/client.go has been changed by 3 CVE fixes, from 2026 to 2026.
How large is a typical CVE fix in nats-io/nats-server?: The median fix changes 19 lines. 55% of fixes change 20 lines or fewer, and 30% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track nats-io/nats-server CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing