What is GHSA-55h8-8g96-x4hj?

GHSA-55h8-8g96-x4hj is a security advisory published by GitHub Security Advisories with Medium severity. NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers

Which CVE IDs does GHSA-55h8-8g96-x4hj cover?

GHSA-55h8-8g96-x4hj covers the following CVE IDs: CVE-2026-33246. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-55h8-8g96-x4hj?

GHSA-55h8-8g96-x4hj has a CVSS v3 base score of 6.4, published by GitHub Security Advisories.

Which products are affected by GHSA-55h8-8g96-x4hj?

GHSA-55h8-8g96-x4hj affects 3 products, including: go/github.com/nats-io/nats-server/v2:\u003c 2.11.15; go/github.com/nats-io/nats-server/v2:\u003e= 2.12.0-RC.1, \u003c 2.12.6; go/github.com/nats-io/nats-server:\u003e 0.

GHSA-55h8-8g96-x4hjMediumCVSS 6.4

NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers

Vendor

GitHub Security Advisories

Published

March 24, 2026

Last Modified

March 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-33246 →

📋 Description

Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The nats-server allows hub/spoke topologies using "leafnode" connections by other nats-servers. NATS messages can have headers.

Problem Description

The nats-server offers a Nats-Request-Info: message header, providing information about a request. This is supposed to provide enough information to allow for account/user identification, such that NATS clients could make their own decisions on how to trust a message, provided that they trust the nats-server as a broker.

A leafnode connecting to a nats-server is not fully trusted unless the system account is bridged too. Thus identity claims should not have propagated unchecked.

Thus NATS clients relying upon the Nats-Request-Info: header could be spoofed.

Does not directly affect the nats-server itself, but the CVSS Confidentiality and Integrity scores are based upon what a hypothetical client might choose to do with this NATS header.

Affected Versions

Any version before v2.12.6 or v2.11.15

Workarounds

None.

🎯 Affected products3

go/github.com/nats-io/nats-server/v2:< 2.11.15
go/github.com/nats-io/nats-server/v2:>= 2.12.0-RC.1, < 2.12.6
go/github.com/nats-io/nats-server:> 0