The vulnerability is an integer overflow in the Connz pagination logic of NATS Server. A client that can send account‑scoped connection monitoring requests can trigger the overflow by providing Offset and Limit values that exceed the internal arithmetic limits before bounds are safely applied, causing the server to crash. This flaw is a classic Arithmetic Overflow (CWE‑190) and results in a denial‑of‑service condition rather than code execution.

The issue affects NATS Server from NATS.io, the high‑performance messaging server, for all releases prior to 2.12.12 and 2.14.3. Any installation of those versions that allows external clients to use the Connz monitoring endpoint is vulnerable.

The CVSS score of 7.7 classifies the flaw as high severity, and the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is listed outside of CISA’s KEV catalog. The attack vector is network‑based: an attacker must be able to send a malformed Connz request to the server. Successful exploitation would terminate the NATS Server and interrupt service availability for all connected clients, but it does not grant an attacker persistence or remote code execution.