A malformed message sent to the leafnode port of NATS-Server causes a pre-authentication crash that can terminate the service. The denial of service can be triggered by any network actor that can reach the leafnode interface, without authentication, resulting in loss of availability for all connected clients. The issue arises from improper input handling and an unguarded panic path (CWE‑20 and CWE‑1286).

All NATS‑IO NATS‑Server releases prior to 2.11.15 and 2.12.6 are vulnerable; any client that can connect to the leafnode port jeopardizes the system. The vulnerability impacts only the server process and does not compromise data confidentiality or integrity.

The CVSS score of 7.5 designates this as a high severity flaw, while an EPSS score of less than one percent indicates that exploitation is currently uncommon. It is not listed in the CISA KEV catalog. Because the leafnode port is a network-facing endpoint, an attacker who can reach it can trigger the crash immediately, with no authentication or additional privileges required. The threat is mitigated by disabling leafnode support or restricting network access to the port.