NATS Server may fail to authorize certain Jetstream admin APIs

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

9.6 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

EPSS

• CVE-2025-30215: 0.60% estimated exploitation activity in the next 30 days; percentile 48.81 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Advisory The management of JetStream assets happens with messages in the $JS. subject namespace in the system account; this is partially exposed into regular accounts to allow account holders to manage their assets. Some of the JS API requests were missing access controls, allowing any user with JS management permissions in any account to perform certain administrative actions on any JS asset in any other account. At least one of the unprotected APIs allows for data destruction. None of the affected APIs allow disclosing stream contents. Affected versions NATS Server: Version 2 from v2.2.0 onwards, prior to v2.11.1 or v2.10.27 ----- Original Report (Lightly edited to confirm some supposition and in the summary to use past tense) Summary nats-server did not include authorization checks on 4 separate admin-level JetStream APIs: account purge, server remove, account stream move, and account stream cancel-move. In all cases, APIs are not properly restricted to system-account users.…

Published by the source

15 Apr 2025, 21:45 UTC

Last modified by the source

5 Jun 2026, 21:36 UTC

Source last checked

26 Oct 2026, 15:23 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-fhg8-qxh5-7q3w

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2025-30215

Advisory: NATS Server may fail to authorize certain Jetstream admin APIs
IDs: CVE-2025-30215, GHSA-fhg8-qxh5-7q3w
Record: https://patchnext.com/advisories/cve-2025-30215 (revision 1, source checked 26 Oct 2026, 15:23 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Critical (CVSS 9.6)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: github.com/nats-io/nats-server/v2 2.11.1, 2.10.27. A vendor fix does not mean a deployment is fixed.

## Affected components
- Go github.com/nats-io/nats-server/v2: affected >= 2.11.0-RC.1, < 2.11.1; >= 2.2.0, < 2.10.27; fixed in 2.10.27, 2.11.1

## Suggested inspection (read-only)
- Go github.com/nats-io/nats-server/v2: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on github.com/nats-io/nats-server/v2.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-fhg8-qxh5-7q3w (GitHub-reviewed advisory GHSA-fhg8-qxh5-7q3w lists affected ranges: Go github.com/nats-io/nats-server/v2 >=2.11.0-RC.1 =2.2.0 <2.10.27)

Commands are suggestions: review each one before running it.