AIKIDO-2026-10976
NATS.Client.Core is vulnerable to Denial of Service (DoS)
65
Medium Risk
This Affects:
NATS.Client.CoreTL;DR
The NATS .NET client parses incoming server protocol frames and reuses pooled byte buffers for connection and publish paths. Before the fix, malformed or oversized MSG/HMSG lengths from an untrusted server could drive excessive allocations and availability loss, subjects containing whitespace or CRLF were accepted by default enabling protocol injection, and pooled buffers could retain credentials or tokens across rentals. JetStream pinned consumers could also mishandle duplicate Nats-Pin-Id headers. The patch enforces hard incoming payload limits, enables subject validation by default, clears pooled memory on return, and reads the latest Pin ID value.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
NATS.Client.Core is vulnerable to Denial of Service (DoS) in versions 2.0.0 - 2.7.3.
How to fix this
Upgrade the NATS.Client.Core and/or NATS.Client.JetStream library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant