CVE-2026-33223CWE-290

NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing

Medium · published March 25, 2026

CVSS v3.1
6.4
EPSS
0%
Percentile
15.3
In the wild
Unconfirmed
What it is

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, the NATS message header `Nats-Request-Info:` is supposed to be a guarantee of identity by the NATS server, but the stripping of this header from inbound messages was not fully effective. An attacker with valid credentials for any regular client interface could thus spoof their identity to services which rely upon this header. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00248 · 15.3th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2026-03-25T20:20Z
EPSS history
Timeline
  • 25 MAR 20:20Z
    NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing
    cvelistv5