NATS Server suffers a crash during the pre‑authentication leafnode handshake when an unauthenticated peer repeatedly sends leafnode INFO protocol messages before account setup, leading to a server crash and service disruption for all connections.

The vulnerability affects NATS Server from the nats‑io vendor. All releases prior to version 2.12.8 and 2.11.17 are impacted. The issue is resolved in releases 2.12.8 and 2.11.17 and later.

The CVSS score of 7.5 indicates a high‑severity denial‑of-service flaw. The exploit requires unauthenticated network access to a leafnode listener with compression enabled, which is typically available to external peers. Based on the description, it is inferred that an external peer could reach the leafnode listener, making the attack vector possible from outside. EPSS indicates a very low but non‑zero probability of exploitation, with a score below 1%, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation yet. Nonetheless, an attacker with network reach to the affected port could intentionally trigger the crash and disrupt availability.