Vulnerability Description
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.1 and 2.12.9, an MQTT client could include protocol control characters in subscription filters that were later forwarded as NATS protocol data to route or leafnode connections, corrupting the forwarded protocol stream and allowing injection of unintended NATS protocol operations. This issue is fixed in versions 2.14.1 and 2.12.9.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linuxfoundation | Nats-Server | < 2.12.9 |
Related Weaknesses (CWE)
References
- https://github.com/nats-io/nats-server/commit/366837cfc65ab9ccb4f98193c65e8daf23Patch
- https://github.com/nats-io/nats-server/commit/64ebae40051ee497c481e10f316238faf0Patch
- https://github.com/nats-io/nats-server/commit/f14856b9e57a36818f43851cb69b6e3367Patch
- https://github.com/nats-io/nats-server/pull/8163Issue TrackingPatch
- https://github.com/nats-io/nats-server/pull/8164Issue TrackingPatch
- https://github.com/nats-io/nats-server/releases/tag/v2.12.9Release Notes
- https://github.com/nats-io/nats-server/releases/tag/v2.14.1Release Notes
- https://github.com/nats-io/nats-server/security/advisories/GHSA-qrcv-3558-gj4fVendor Advisory
FAQ
What is CVE-2026-58213?
CVE-2026-58213 is a vulnerability with a CVSS score of 7.1 (HIGH). NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.1 and 2.12.9, an MQTT client could include protocol control characters in subscription f...
How severe is CVE-2026-58213?
CVE-2026-58213 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-58213?
Check the references section above for vendor advisories and patch information. Affected products include: Linuxfoundation Nats-Server.