CVE-2026-58213
NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection
CVSS Score
7.1
EPSS Score
0.4%
EPSS Percentile
35th
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.1 and 2.12.9, an MQTT client could include protocol control characters in subscription filters that were later forwarded as NATS protocol data to route or leafnode connections, corrupting the forwarded protocol stream and allowing injection of unintended NATS protocol operations. This issue is fixed in versions 2.14.1 and 2.12.9.
| CWE | CWE-74 |
| Vendor | nats-io |
| Product | nats-server |
| Published | Jul 8, 2026 |
| Last Updated | Jul 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for nats-io nats-server
Be the first to know when new high vulnerabilities affecting nats-io nats-server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None
Affected Versions
nats-io / nats-server
< 2.12.9 >= 2.14.0-RC.1, < 2.14.1
References
github.com: https://github.com/nats-io/nats-server/security/advisories/GHSA-qrcv-3558-gj4f github.com: https://github.com/nats-io/nats-server/pull/8163 github.com: https://github.com/nats-io/nats-server/pull/8164 github.com: https://github.com/nats-io/nats-server/commit/366837cfc65ab9ccb4f98193c65e8daf238582d8 github.com: https://github.com/nats-io/nats-server/commit/64ebae40051ee497c481e10f316238faf0de1736 github.com: https://github.com/nats-io/nats-server/commit/f14856b9e57a36818f43851cb69b6e33670885c9 github.com: https://github.com/nats-io/nats-server/releases/tag/v2.12.9 github.com: https://github.com/nats-io/nats-server/releases/tag/v2.14.1