CVE-2026-58209
NATS Server: MQTT retained and QoS replay bypass subscribe deny filters
CVSS Score
4.3
EPSS Score
0.3%
EPSS Percentile
26th
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured subscribe deny rule because these delivery paths did not consistently recheck the concrete original topic before sending the MQTT PUBLISH to the subscriber. This issue is fixed in versions 2.14.3 and 2.12.12.
| CWE | CWE-863 |
| Vendor | nats-io |
| Product | nats-server |
| Published | Jul 8, 2026 |
| Last Updated | Jul 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for nats-io nats-server
Be the first to know when new medium vulnerabilities affecting nats-io nats-server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
nats-io / nats-server
< 2.12.12 >= 2.14.0-RC.1, < 2.14.3
References
github.com: https://github.com/nats-io/nats-server/security/advisories/GHSA-7qmq-8cc4-hxwg github.com: https://github.com/nats-io/nats-server/commit/181b1f51f40b9954c57e9d478e051fb257679356 github.com: https://github.com/nats-io/nats-server/commit/1c429b6fdc5afd4188cc5faf1127f6334896cd87 github.com: https://github.com/nats-io/nats-server/releases/tag/v2.12.12 github.com: https://github.com/nats-io/nats-server/releases/tag/v2.14.3