An unauthenticated attacker who can connect to a NATS Server that has leafnode configuration enabled can send specialized compressed data that triggers a server panic, immediately crashing the process and disrupting messaging operations. The result is a denial of service with no direct data exposure or code execution; the weakness aligns with the identified CWEs, reflecting erroneous resource handling and null pointer usage.

The flaw affects the NATS.io NATS Server messaging platform in versions earlier than 2.11.14 and 2.12.5. It is present in any deployment where the leafnode feature is active and the default compression setting is enabled, regardless of the operating system used.

The CVSS score of 7.5 denotes high severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack requires only network connectivity to the leafnode port and occurs before authentication; thus the attack vector is remote, making broad network exposure a critical concern.