Executive brief
NATS Server is a high-performance messaging system used for cloud and edge computing. A vulnerability in how the server handles monitoring requests allows a connected user to crash the server by sending specially crafted messages. This results in a denial-of-service, disrupting communication across the entire messaging network.
Technical details
An integer overflow vulnerability (CWE-190) exists in the NATS Server monitoring endpoints (Connz and Subsz). The flaw is located in the pagination logic where 'Offset' and 'Limit' values are processed; specifically, these values can overflow internal arithmetic before the response window is safely bounded. An attacker with the ability to send account-scoped connection monitoring requests can exploit this to trigger a panic and crash the server. In no-auth deployments, any client with network access can trigger the crash, while in multi-tenant environments, the attacker must have permissions to publish to the account monitoring request subject. The issue is resolved in versions 2.14.3 and 2.12.12.
Affected products
- nats-io nats-server < 2.12.12, >= 2.14.0-RC.1, < 2.14.3
Timeline
- 2026-06-29: patched: Versions 2.14.3 and 2.12.12 released
- 2026-06-29: advisory: GitHub Security Advisory GHSA-q59r-vq66-pxc2 published
- 2026-07-08: disclosed: CVE-2026-58207 published to NVD
References
- https://github.com/nats-io/nats-server/commit/2ae047139e37a38cb01e259a67909e7a39fa38e9
- https://github.com/nats-io/nats-server/commit/894d9411927681d66ce349bf1afe49608dc0c1a3
- https://github.com/nats-io/nats-server/releases/tag/v2.12.12
- https://github.com/nats-io/nats-server/releases/tag/v2.14.3
- https://github.com/nats-io/nats-server/security/advisories/GHSA-q59r-vq66-pxc2