# CVE-2026-58210: NATS Server denial of service via MQTT memory exhaustion

Source: https://junglewise.ai/threats/cve-2026-58210-nats-server-denial-of-service-via-mqtt-memory-exhaustion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-58210 · Severity: high · CVSS 7.5 · Published 2026-07-08

NATS Server is a high-performance messaging system used for cloud and edge computing. A vulnerability in its MQTT handling allows unauthenticated attackers to crash or slow down the server by sending large, incomplete connection requests. This can lead to a denial-of-service, disrupting communications for all connected applications and services.

## Quick answers

**Is CVE-2026-58210 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58210 being exploited in the wild.

**How severe is CVE-2026-58210?** High severity, with a CVSS score of 7.5, published 8 July 2026.

**Which products and versions are affected?** nats-io nats-server < 2.12.12, >= 2.14.0-RC.1, < 2.14.3.

**Is there a fix for CVE-2026-58210?** A patch was published on 2026-06-29: Version 2.12.12 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58210 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-58210?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

NATS Server prior to versions 2.14.3 and 2.12.12 contains a resource consumption vulnerability (CWE-400) in its MQTT parser. An unauthenticated remote attacker can send an MQTT CONNECT packet with a large advertised length but only transmit a portion of the data. The server buffers these incomplete packets in memory while waiting for the remaining data or an authentication timeout, leading to memory exhaustion. The fix introduces a check to reject MQTT packets that exceed the client's maximum payload limit before buffering occurs.

## Affected products

- nats-io nats-server < 2.12.12, >= 2.14.0-RC.1, < 2.14.3

## Timeline

- 2026-06-12: other: Vulnerability fixed in source code
- 2026-06-29: patched: Version 2.12.12 released
- 2026-07-08: disclosed: CVE-2026-58210 published

## References

- [https://github.com/nats-io/nats-server/commit/bce9ef39469e610aeddb819194ceb7f7edfc0861](https://github.com/nats-io/nats-server/commit/bce9ef39469e610aeddb819194ceb7f7edfc0861)
- [https://github.com/nats-io/nats-server/commit/e016e47bbf70304945f2ae9dc397e4862adefaf5](https://github.com/nats-io/nats-server/commit/e016e47bbf70304945f2ae9dc397e4862adefaf5)
- [https://github.com/nats-io/nats-server/releases/tag/v2.12.12](https://github.com/nats-io/nats-server/releases/tag/v2.12.12)
- [https://github.com/nats-io/nats-server/releases/tag/v2.14.3](https://github.com/nats-io/nats-server/releases/tag/v2.14.3)
- [https://github.com/nats-io/nats-server/security/advisories/GHSA-r72h-j7qq-v6qg](https://github.com/nats-io/nats-server/security/advisories/GHSA-r72h-j7qq-v6qg)