# CVE-2026-58207: NATS Server integer overflow in Connz pagination monitoring requests

Source: https://junglewise.ai/threats/cve-2026-58207-nats-server-integer-overflow-in-connz-pagination-monitoring  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-58207 · Severity: high · CVSS 7.7 · Published 2026-07-08

NATS Server is a high-performance messaging system used for cloud and edge computing. A vulnerability in how the server handles monitoring requests allows a connected user to crash the server by sending specially crafted messages. This results in a denial-of-service, disrupting communication across the entire messaging network.

## Quick answers

**Is CVE-2026-58207 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58207 being exploited in the wild.

**How severe is CVE-2026-58207?** High severity, with a CVSS score of 7.7, published 8 July 2026.

**Which products and versions are affected?** nats-io nats-server < 2.12.12, >= 2.14.0-RC.1, < 2.14.3.

**Is there a fix for CVE-2026-58207?** A patch was published on 2026-06-29: Versions 2.14.3 and 2.12.12 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58207 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-58207?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow vulnerability (CWE-190) exists in the NATS Server monitoring endpoints (Connz and Subsz). The flaw is located in the pagination logic where 'Offset' and 'Limit' values are processed; specifically, these values can overflow internal arithmetic before the response window is safely bounded. An attacker with the ability to send account-scoped connection monitoring requests can exploit this to trigger a panic and crash the server. In no-auth deployments, any client with network access can trigger the crash, while in multi-tenant environments, the attacker must have permissions to publish to the account monitoring request subject. The issue is resolved in versions 2.14.3 and 2.12.12.

## Affected products

- nats-io nats-server < 2.12.12, >= 2.14.0-RC.1, < 2.14.3

## Timeline

- 2026-06-29: patched: Versions 2.14.3 and 2.12.12 released
- 2026-06-29: advisory: GitHub Security Advisory GHSA-q59r-vq66-pxc2 published
- 2026-07-08: disclosed: CVE-2026-58207 published to NVD

## References

- [https://github.com/nats-io/nats-server/commit/2ae047139e37a38cb01e259a67909e7a39fa38e9](https://github.com/nats-io/nats-server/commit/2ae047139e37a38cb01e259a67909e7a39fa38e9)
- [https://github.com/nats-io/nats-server/commit/894d9411927681d66ce349bf1afe49608dc0c1a3](https://github.com/nats-io/nats-server/commit/894d9411927681d66ce349bf1afe49608dc0c1a3)
- [https://github.com/nats-io/nats-server/releases/tag/v2.12.12](https://github.com/nats-io/nats-server/releases/tag/v2.12.12)
- [https://github.com/nats-io/nats-server/releases/tag/v2.14.3](https://github.com/nats-io/nats-server/releases/tag/v2.14.3)
- [https://github.com/nats-io/nats-server/security/advisories/GHSA-q59r-vq66-pxc2](https://github.com/nats-io/nats-server/security/advisories/GHSA-q59r-vq66-pxc2)