Is CVE-2026-58208 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58208 being exploited in the wild.

How severe is CVE-2026-58208?

Medium severity, with a CVSS score of 6.8, published 8 July 2026.

Which products and versions are affected?

nats-io nats-server >= 2.14.0-RC.1, < 2.14.3; < 2.12.12.

Is there a fix for CVE-2026-58208?

A patch was published on 2026-06-29: Release date of fixed versions 2.12.12 and 2.14.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-58208 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-58208?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58208: NATS Server denial of service via WebSocket MQTT upgrade

Q: Is there a fix for CVE-2026-58208?

A patch was published on 2026-06-29: Release date of fixed versions 2.12.12 and 2.14.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-58208 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-58208?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58208 · Severity: medium · CVSS 6.8 · Published 2026-07-08

NATS Server is a high-performance messaging system used for cloud and edge computing. A vulnerability in the WebSocket component allows unauthenticated remote users to crash the server by sending a specific request, even if the MQTT feature is disabled. This can lead to a complete service outage, disrupting communication between applications and devices.

Quick answers

Is CVE-2026-58208 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58208 being exploited in the wild.
How severe is CVE-2026-58208?: Medium severity, with a CVSS score of 6.8, published 8 July 2026.
Which products and versions are affected?: nats-io nats-server >= 2.14.0-RC.1, < 2.14.3; < 2.12.12.
Is there a fix for CVE-2026-58208?: A patch was published on 2026-06-29: Release date of fixed versions 2.12.12 and 2.14.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58208 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-58208?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in NATS Server where the WebSocket listener incorrectly routes requests for the MQTT-over-WebSocket path into MQTT handling logic even when MQTT is not explicitly configured. An unauthenticated remote attacker can exploit this by sending a WebSocket upgrade request to the /mqtt path. This causes the server to access uninitialized MQTT state, resulting in a NULL pointer dereference or similar uncaught exception (panic) that crashes the server process. The issue is tracked as CWE-248 and has been patched in versions 2.14.3 and 2.12.12.

Affected products

nats-io nats-server >= 2.14.0-RC.1, < 2.14.3; < 2.12.12

Timeline

2026-07-08: disclosed
2026-07-08: advisory
2026-06-29: patched: Release date of fixed versions 2.12.12 and 2.14.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.