Is CVE-2026-58210 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58210 being exploited in the wild.

How severe is CVE-2026-58210?

High severity, with a CVSS score of 7.5, published 8 July 2026.

Which products and versions are affected?

nats-io nats-server = 2.14.0-RC.1, < 2.14.3.

Is there a fix for CVE-2026-58210?

A patch was published on 2026-06-29: Version 2.12.12 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-58210 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-58210?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58210: NATS Server denial of service via MQTT memory exhaustion

Q: Is there a fix for CVE-2026-58210?

A patch was published on 2026-06-29: Version 2.12.12 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-58210 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-58210?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58210 · Severity: high · CVSS 7.5 · Published 2026-07-08

NATS Server is a high-performance messaging system used for cloud and edge computing. A vulnerability in its MQTT handling allows unauthenticated attackers to crash or slow down the server by sending large, incomplete connection requests. This can lead to a denial-of-service, disrupting communications for all connected applications and services.

Quick answers

Is CVE-2026-58210 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58210 being exploited in the wild.
How severe is CVE-2026-58210?: High severity, with a CVSS score of 7.5, published 8 July 2026.
Which products and versions are affected?: nats-io nats-server < 2.12.12, >= 2.14.0-RC.1, < 2.14.3.
Is there a fix for CVE-2026-58210?: A patch was published on 2026-06-29: Version 2.12.12 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58210 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-58210?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

NATS Server prior to versions 2.14.3 and 2.12.12 contains a resource consumption vulnerability (CWE-400) in its MQTT parser. An unauthenticated remote attacker can send an MQTT CONNECT packet with a large advertised length but only transmit a portion of the data. The server buffers these incomplete packets in memory while waiting for the remaining data or an authentication timeout, leading to memory exhaustion. The fix introduces a check to reject MQTT packets that exceed the client's maximum payload limit before buffering occurs.

Affected products

nats-io nats-server < 2.12.12, >= 2.14.0-RC.1, < 2.14.3

Timeline

2026-06-12: other: Vulnerability fixed in source code
2026-06-29: patched: Version 2.12.12 released
2026-07-08: disclosed: CVE-2026-58210 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.