NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Mar 25, 2026 · NIST NVD

   Detected

   NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, users with JetStream admin API access to restore one stream could restore to other stream names, impacting data which should have been protected against them. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, if developers have configured users to have lim

2. Jun 17, 2026 · NIST NVD

   Updated

   NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, users with JetStream admin API access to restore one stream could restore to other stream names, impacting data which should have been protected against them. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, if developers have configured users to have lim

Affected

• cpe linuxfoundation/nats-serverversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-33222

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-33222

  NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, users with JetStream admin API access to restore one stream could restore to other stream names, impacting data which should have been protected a

  nvd.nist.gov

References

• Mitigation · advisories.nats.io
• Mitigation · github.com