Cloudanix VulnDB

CVE-2026-29785

High · 7.5

CVSS

7.5

EPSS

1.0%

Published

Mar 25, 2026

CISA due date

—

The record

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.14 and 2.12.5, if the nats-server has the "leafnode" configuration enabled (not default), then anyone who can connect can crash the nats-server by triggering a panic. This happens pre-authentication and requires that compression be enabled (which it is, by default, when leafnodes are used). Versions 2.11.14 and 2.12.5 contain a fix. As a workaround, disable compression on the leafnode port.

Affected packages

Ecosystem Package Introduced Fixed
Chainguard k3s 0 1.35.2.1-r3
Chainguard k3s-1.32 0 1.32.13.1-r5
Chainguard k3s-1.33 0 1.33.9.1-r5
Chainguard k3s-static 0 1.35.2.1-r3
Chainguard k3s-static-1.32 0 1.32.13.1-r5
Chainguard k3s-static-1.33 0 1.33.9.1-r5
Chainguard kine 0 0.14.15-r0
Chainguard milvus-2.5 0 2.5.27-r4
Chainguard nats 0 0.3.2-r0
Chainguard nats-fips 0 0.3.2-r0
Chainguard nats-top 0 0.6.3-r17
Chainguard nats-top-fips 0 0.6.3-r15
Chainguard prometheus-nats-exporter 0 0.19.1-r3
Chainguard prometheus-nats-exporter-fips 0 0.19.1-r3
Chainguard rke2-runtime-1.33 0 1.33.9.2.1-r2
Chainguard rke2-runtime-1.34 0 1.34.5.2.1-r2
Chainguard rke2-runtime-1.35 0 1.35.2.2.1-r2
Chainguard rke2-runtime-fips-1.33 0 1.33.9.2.1-r2
Chainguard rke2-runtime-fips-1.34 0 1.34.6.2.1-r1
Chainguard rke2-runtime-fips-1.35 0 1.35.2.2.1-r1
Chainguard telegraf-1.37 0 1.37.3-r5
Wolfi k3s 0 1.35.2.1-r3
Wolfi k3s-1.32 0 1.32.13.1-r5
Wolfi k3s-1.33 0 1.33.9.1-r5
Wolfi k3s-static 0 1.35.2.1-r3
Wolfi k3s-static-1.32 0 1.32.13.1-r5
Wolfi k3s-static-1.33 0 1.33.9.1-r5
Wolfi kine 0 0.14.15-r0
Wolfi nats 0 0.3.2-r0
Wolfi nats-top 0 0.6.3-r17
Wolfi prometheus-nats-exporter 0 0.19.1-r3
Wolfi telegraf-1.37 0 1.37.3-r5
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20260326T203309-150000.1.155.2

Related vulnerabilities