Critical Access Control Vulnerability in NATS-Server: Data Destruction Risk
Summary
CVE-2025-30215: NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. Affects nats-server versions 2.10.1-1 – 2.9.19-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NATS-Server is a high-performance messaging server designed for cloud and edge native applications. It facilitates communication between distributed systems through a lightweight publish-subscribe model. The server supports JetStream, which allows for advanced message streaming and persistence. However, certain versions of NATS-Server have been found to have vulnerabilities in the management of JetStream assets, exposing them to unauthorized access.
Vulnerability Detail
The vulnerability, identified as CVE-2025-30215, affects NATS-Server versions from 2.2.0 up to but not including 2.10.27 and 2.11.1. It arises from insufficient access controls on specific JetStream API requests, allowing users with management permissions in one account to perform administrative actions on JetStream assets in other accounts. This could lead to unauthorized data destruction, although the affected APIs do not allow for the disclosure of stream contents.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can restrict access to JetStream management permissions to prevent unauthorized actions until the server is updated. This can be done by reviewing and modifying user roles and permissions within the NATS-Server configuration.
Conclusion
The CVE-2025-30215 vulnerability in NATS-Server poses a significant risk due to inadequate access controls on JetStream API requests. Users are strongly advised to update to the patched versions to mitigate the risk of unauthorized data destruction. Implementing temporary access restrictions can provide additional security until the update is completed.
See every vulnerability recorded for nats-server →
FAQ
NATS-Server versions from 2.2.0 up to but not including 2.10.27 and 2.11.1 are affected.
Users with management permissions can perform administrative actions on JetStream assets in other accounts, including potential data destruction.
No, the affected APIs do not allow for the disclosure of stream contents.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
Restrict access to JetStream management permissions as a temporary workaround until you can update to a secure version.
Related vulnerabilities
Recent vulnerabilities recorded for nats-server.
