High severity · published Jul 8, 2026
CVE-2026-58210
NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an unauthenticated MQTT client could cause the server to retain large incomplete MQTT CONNECT packets before authentication completed, consuming server memory while the parser waited for the advertised MQTT packet length. This issue is fixed in versions 2.14.3 and 2.12.12.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NA
nats-server · nats-io
< 2.12.12; >= 2.14.0-RC.1, < 2.14.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-58210
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-58210
Patch
https://github.com/nats-io/nats-server/commit/bce9ef39469e610aeddb819194ceb7f7edfc0861
Patch
https://github.com/nats-io/nats-server/commit/e016e47bbf70304945f2ae9dc397e4862adefaf5
Release Notes
https://github.com/nats-io/nats-server/releases/tag/v2.12.12
Release Notes
https://github.com/nats-io/nats-server/releases/tag/v2.14.3
Vendor Advisory
https://github.com/nats-io/nats-server/security/advisories/GHSA-r72h-j7qq-v6qg
More from nats-server
8.8
CVE-2026-58253
NATS Server: Route API Auth Bypass
7.5
CVE-2026-58208
NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled
7.5
CVE-2026-58250
NATS Server: Pre-auth server crash via double INFO in leafnode handshake
7.5
CVE-2026-33218
NATS has pre-auth server panic via leafnode handling
7.5
CVE-2026-33216
NATS has MQTT plaintext password disclosure