NATS‑Server is a high‑performance messaging server that relies on a request header, Nats‑Request‑Info, to identify the source of a message. In versions prior to 2.11.15 and 2.12.6, the server does not fully strip this header from inbound traffic, which means that a client can embed the header and have it accepted as its own identity. The result is that a legitimate client can impersonate any other service that relies on this header for authentication, creating a path for deception and unauthorized access. The weakness falls under incorrect authorization (CWE‑290) and improper handling of sensitive information (CWE‑807).

NATS Server from nats‑io is affected in versions older than 2.11.15 and 2.12.6. These releases are the ones that fail to remove the Nats‑Request‑Info header entirely, allowing identity spoofing. Documentation and advisories explicitly list these two versions as vulnerable.

The CVSS score of 6.4 indicates a moderate severity, while the EPSS score of less than 1% suggests that exploitation is currently rare in the wild and the vulnerability is not yet leveraged in known attacks. The vulnerability does not appear in CISA’s KEV catalog. An attacker must have valid credentials to any regular client interface to send messages, but once credentials exist, the attack vector is network‑bound; any client can supply a forged header to override the server’s perceived identity. The potential impact is limited to services that depend on the header for authentication or authorization decisions, but could allow privilege escalation or denial of service within a trusted environment.