CVE-2026-29785

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.14 and 2.12.5, if the nats-server has the "leafnode" configuration enabled (not default), then anyone who can connect can crash the nats-server by triggering a panic. This happens pre-authentication and requires that compression be enabled (which it is, by default, when leafnodes are used). Versions 2.11.14 and 2.12.5 contain a fix. As a workaround, disable compression on the leafnode port.

• CWE-476
• CWE-409

• https://advisories.nats.io/CVE/secnote-2026-04.txtMitigation, Vendor Advisory
• https://github.com/nats-io/nats-server/commit/a1488de6f2ba6e666aef0f9cce0016f7f167d6a8Patch
• https://github.com/nats-io/nats-server/security/advisories/GHSA-52jh-2xxh-pwh6Mitigation, Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:21769
• https://access.redhat.com/errata/RHSA-2026:22347
• https://access.redhat.com/errata/RHSA-2026:23345
• https://access.redhat.com/security/cve/CVE-2026-29785
• https://bugzilla.redhat.com/show_bug.cgi?id=2451444
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29785.json

Published

Mar 25, 2026

Last Modified

Aug 10, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2978A vulnerability was detected in FastApiAdmin up to 2.2.0. Th…8.8
• CVE-2026-29780eml_parser serves as a python module for parsing eml files a…5.5
• CVE-2026-29781Sliver is a command and control framework that uses a custom…6.5
• CVE-2026-29782OpenSTAManager is an open source management software for tec…7.2
• CVE-2026-29783The shell tool within GitHub Copilot CLI versions prior to a…7.8
• CVE-2026-29784Ghost is a Node.js content management system. From version 5…8.8
• CVE-2026-29786node-tar is a full-featured Tar for Node.js. Prior to versio…6.3
• CVE-2026-29787mcp-memory-service is an open-source memory backend for mult…5.3
• CVE-2026-29788TSPortal is the WikiTide Foundation’s in-house platform used…7.5
• CVE-2026-29789Vito is a self-hosted web application that helps manage serv…8.8
• CVE-2026-2979A flaw has been found in FastApiAdmin up to 2.2.0. This issu…8.8
• CVE-2026-29790dbt-common is the shared common utilities for dbt-core and a…5.3