CVE-2026-29785: 
NixOS vulnerability analysis and mitigation

CVE-2026-29785 is a denial-of-service vulnerability in NATS-Server, a high-performance messaging server for NATS.io, caused by a NULL pointer dereference in the leafnode compression handling. When the leafnode feature is enabled (non-default) and compression is active (default when leafnodes are used), an unauthenticated remote attacker can send malicious protocol messages before authentication completes, triggering a server panic and crash. Affected versions include all NATS-Server v2 releases prior to 2.11.14 and 2.12.0-RC.1 through 2.12.4. The vulnerability was published on March 24, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, NATS Advisory).

The root cause is a NULL pointer dereference (CWE-476) combined with improper handling of highly compressed data (CWE-409) in the leafnode protocol processing code (server/leafnode.go). When compression is enabled on the leafnode port (using the default s2_auto mode), the server uses c.ping.tmr for the auth timer instead of c.atmr, causing awaitingAuth() to return false. This allows LS+ (leaf subscribe) or LS- (leaf unsubscribe) protocol commands to reach processLeafSub or processLeafUnsub before a CONNECT message has been processed and c.acc (the account pointer) has been set — resulting in a nil pointer dereference and server panic. The fix adds explicit nil checks for c.acc in both functions, sending an "Authorization Violation" error and closing the connection if the account is not yet set (GitHub Commit, GitHub Advisory).

Successful exploitation results in a complete denial of service of the affected NATS-Server instance, as the server process crashes via a Go panic. The attack requires no authentication and no user interaction, and can be triggered by any network-reachable attacker against the leafnode port (typically TCP/7422). There is no confidentiality or integrity impact; however, disruption of the NATS messaging infrastructure could cascade to dependent cloud-native, IoT, or edge computing workloads that rely on the server for pub-sub communication (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The vulnerability is pre-authentication and requires only network access to the leafnode port, making it low-complexity to exploit on servers with the leafnode feature enabled. The EPSS score is approximately 0.073% (34th percentile), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify NATS-Server instances with the leafnode port exposed (default TCP/7422) using network scanning tools such as Shodan, Censys, or nmap (nmap -p 7422 <target>).
2. Confirm leafnode and compression: Connect to the port and read the INFO message sent by the server. If the server responds with an INFO JSON blob, the leafnode port is active. The presence of compression negotiation fields in the INFO indicates compression is enabled (default with leafnodes).
3. Send pre-auth LS+ command: Without sending a CONNECT message, immediately write an LS+ <subject>\r\n command (e.g., LS+ test\r\n) to the TCP connection. This bypasses the authentication state check due to the compression-induced timer swap.
4. Trigger server panic: The server attempts to process the LS+ command in processLeafSub, dereferences the nil c.acc pointer, and panics, crashing the NATS-Server process and causing a denial of service (GitHub Commit, GitHub Advisory).

• Network: Unexpected TCP connections to the leafnode port (default 7422) from untrusted or external IP addresses; connections that send data immediately after the INFO message without a CONNECT handshake.
• Logs: NATS-Server logs showing a Go panic stack trace referencing processLeafSub or processLeafUnsub in server/leafnode.go; log entries indicating abrupt server shutdown or restart.
• Process: Unexpected termination or restart of the nats-server process; process monitoring alerts for the NATS-Server service crashing.
• Application: Clients reporting sudden loss of connectivity to the NATS broker; repeated server restarts in a short time window suggesting repeated exploitation attempts (GitHub Advisory).

Upgrade NATS-Server to version 2.11.14 or 2.12.5 (or later), which contain the fix for this vulnerability. As an immediate workaround if patching is not possible, disable compression on the leafnode port by adding compression: off to the leafnodes block in the server configuration:

leafnodes {
  port: 7422
  compression: off
}

Additionally, restrict network access to the leafnode port to trusted hosts only using firewall rules or network ACLs to reduce the attack surface (GitHub Advisory, NATS Advisory).

The advisory was published by philpennock on the NATS-io GitHub repository on March 24, 2026, and quickly picked up by security aggregators including Red Hat Bugzilla, openSUSE security announcements, and CVE tracking services. Social media accounts such as @thehackerwire on Mastodon noted the disclosure shortly after publication. Red Hat tracked the issue as high severity in their security response process (Red Hat Bugzilla, GitHub Advisory).