Medium severity · published Jul 8, 2026
CVE-2026-58209
NATS Server: MQTT retained and QoS replay bypass subscribe deny filters
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured subscribe deny rule because these delivery paths did not consistently recheck the concrete original topic before sending the MQTT PUBLISH to the subscriber. This issue is fixed in versions 2.14.3 and 2.12.12.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NA
nats-server · nats-io
< 2.12.12; >= 2.14.0-RC.1, < 2.14.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-58209
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-58209
Patch
https://github.com/nats-io/nats-server/commit/181b1f51f40b9954c57e9d478e051fb257679356
Patch
https://github.com/nats-io/nats-server/commit/1c429b6fdc5afd4188cc5faf1127f6334896cd87
Release Notes
https://github.com/nats-io/nats-server/releases/tag/v2.12.12
Release Notes
https://github.com/nats-io/nats-server/releases/tag/v2.14.3
Vendor Advisory
https://github.com/nats-io/nats-server/security/advisories/GHSA-7qmq-8cc4-hxwg
More from nats-server
8.8
CVE-2026-58253
NATS Server: Route API Auth Bypass
7.5
CVE-2026-58208
NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled
7.5
CVE-2026-58210
NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory
7.5
CVE-2026-58250
NATS Server: Pre-auth server crash via double INFO in leafnode handshake
7.5
CVE-2026-33218
NATS has pre-auth server panic via leafnode handling