Executive brief
NATS Server is a high-performance messaging system used for cloud and edge computing. A vulnerability in its MQTT handling allows unauthenticated attackers to crash or slow down the server by sending large, incomplete connection requests. This can lead to a denial-of-service, disrupting communications for all connected applications and services.
Technical details
NATS Server prior to versions 2.14.3 and 2.12.12 contains a resource consumption vulnerability (CWE-400) in its MQTT parser. An unauthenticated remote attacker can send an MQTT CONNECT packet with a large advertised length but only transmit a portion of the data. The server buffers these incomplete packets in memory while waiting for the remaining data or an authentication timeout, leading to memory exhaustion. The fix introduces a check to reject MQTT packets that exceed the client's maximum payload limit before buffering occurs.
Affected products
- nats-io nats-server < 2.12.12, >= 2.14.0-RC.1, < 2.14.3
Timeline
- 2026-06-12: other: Vulnerability fixed in source code
- 2026-06-29: patched: Version 2.12.12 released
- 2026-07-08: disclosed: CVE-2026-58210 published
References
- https://github.com/nats-io/nats-server/commit/bce9ef39469e610aeddb819194ceb7f7edfc0861
- https://github.com/nats-io/nats-server/commit/e016e47bbf70304945f2ae9dc397e4862adefaf5
- https://github.com/nats-io/nats-server/releases/tag/v2.12.12
- https://github.com/nats-io/nats-server/releases/tag/v2.14.3
- https://github.com/nats-io/nats-server/security/advisories/GHSA-r72h-j7qq-v6qg