Junglewise Threat Intelligence

CVE-2026-58250: NATS Server NULL pointer dereference in leafnode handshake

CVE-2026-58250 · Severity: high · CVSS 7.5 · Published 2026-07-08

Technologies: Nats-Io NATS Server.

Executive brief

NATS Server is a high-performance messaging system used for cloud and edge computing. A vulnerability in the way it handles initial connections could allow an unauthenticated attacker to crash the server remotely. This results in a denial-of-service, disrupting communication across the network and impacting application availability.

Technical details

A NULL pointer dereference (CWE-476) exists in NATS Server's leafnode handshake logic when compression is enabled. An unauthenticated remote attacker can trigger a process panic by sending repeated leafnode INFO protocol messages before the authentication and account setup phase is completed. The root cause is that the server attempts to access connection state (c.acc or c.leaf.remote) that has not yet been initialized. The issue is fixed in versions 2.12.8 and 2.11.17; users can mitigate the risk by disabling leafnode compression.

Affected products

  • nats-io nats-server < 2.11.17, >= 2.12.0-preview.1, < 2.12.8

Timeline

  • 2026-06-29: advisory: GitHub Security Advisory GHSA-3g5q-cfh2-cq67 published
  • 2026-07-08: disclosed: CVE-2026-58250 published to NVD
  • 2026-04-27: patched: Fixed versions 2.11.17 and 2.12.8 released

References