Junglewise Threat Intelligence

CVE-2026-58208: NATS Server denial of service via WebSocket MQTT upgrade

CVE-2026-58208 · Severity: medium · CVSS 6.8 · Published 2026-07-08

Technologies: Nats-Io NATS Server.

Executive brief

NATS Server is a high-performance messaging system used for cloud and edge computing. A vulnerability in the WebSocket component allows unauthenticated remote users to crash the server by sending a specific request, even if the MQTT feature is disabled. This can lead to a complete service outage, disrupting communication between applications and devices.

Technical details

A vulnerability exists in NATS Server where the WebSocket listener incorrectly routes requests for the MQTT-over-WebSocket path into MQTT handling logic even when MQTT is not explicitly configured. An unauthenticated remote attacker can exploit this by sending a WebSocket upgrade request to the /mqtt path. This causes the server to access uninitialized MQTT state, resulting in a NULL pointer dereference or similar uncaught exception (panic) that crashes the server process. The issue is tracked as CWE-248 and has been patched in versions 2.14.3 and 2.12.12.

Affected products

  • nats-io nats-server >= 2.14.0-RC.1, < 2.14.3; < 2.12.12

Timeline

  • 2026-07-08: disclosed
  • 2026-07-08: advisory
  • 2026-06-29: patched: Release date of fixed versions 2.12.12 and 2.14.3

References