Login Request a demo
High severity · published Jul 8, 2026
CVE-2026-58213
NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection
7.1
CVSS
0.4%
EPSS
No
On KEV
Description
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.1 and 2.12.9, an MQTT client could include protocol control characters in subscription filters that were later forwarded as NATS protocol data to route or leafnode connections, corrupting the forwarded protocol stream and allowing injection of unintended NATS protocol operations. This issue is fixed in versions 2.14.1 and 2.12.9.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NA
nats-server · nats-io
< 2.12.9; >= 2.14.0-RC.1, < 2.14.1 · source: vendor, NVD
Affected product
NA
nats-server
nats-io
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-58213
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-58213
Patch
https://github.com/nats-io/nats-server/commit/366837cfc65ab9ccb4f98193c65e8daf238582d8
Patch
https://github.com/nats-io/nats-server/commit/64ebae40051ee497c481e10f316238faf0de1736
Patch
https://github.com/nats-io/nats-server/commit/f14856b9e57a36818f43851cb69b6e33670885c9
Issue Tracking
https://github.com/nats-io/nats-server/pull/8163
Issue Tracking
https://github.com/nats-io/nats-server/pull/8164
Release Notes
https://github.com/nats-io/nats-server/releases/tag/v2.12.9
More from nats-server
8.8
CVE-2026-58253
NATS Server: Route API Auth Bypass
7.5
CVE-2026-58208
NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled
7.5
CVE-2026-58210
NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory
7.5
CVE-2026-58250
NATS Server: Pre-auth server crash via double INFO in leafnode handshake
7.5
CVE-2026-33218
NATS has pre-auth server panic via leafnode handling