# CVE-2026-58250: NATS Server NULL pointer dereference in leafnode handshake

Source: https://junglewise.ai/threats/cve-2026-58250-nats-server-null-pointer-dereference-in-leafnode-handshake  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-58250 · Severity: high · CVSS 7.5 · Published 2026-07-08

NATS Server is a high-performance messaging system used for cloud and edge computing. A vulnerability in the way it handles initial connections could allow an unauthenticated attacker to crash the server remotely. This results in a denial-of-service, disrupting communication across the network and impacting application availability.

## Quick answers

**Is CVE-2026-58250 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58250 being exploited in the wild.

**How severe is CVE-2026-58250?** High severity, with a CVSS score of 7.5, published 8 July 2026.

**Which products and versions are affected?** nats-io nats-server < 2.11.17, >= 2.12.0-preview.1, < 2.12.8.

**Is there a fix for CVE-2026-58250?** A patch was published on 2026-04-27: Fixed versions 2.11.17 and 2.12.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58250 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-58250?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A NULL pointer dereference (CWE-476) exists in NATS Server's leafnode handshake logic when compression is enabled. An unauthenticated remote attacker can trigger a process panic by sending repeated leafnode INFO protocol messages before the authentication and account setup phase is completed. The root cause is that the server attempts to access connection state (c.acc or c.leaf.remote) that has not yet been initialized. The issue is fixed in versions 2.12.8 and 2.11.17; users can mitigate the risk by disabling leafnode compression.

## Affected products

- nats-io nats-server < 2.11.17, >= 2.12.0-preview.1, < 2.12.8

## Timeline

- 2026-06-29: advisory: GitHub Security Advisory GHSA-3g5q-cfh2-cq67 published
- 2026-07-08: disclosed: CVE-2026-58250 published to NVD
- 2026-04-27: patched: Fixed versions 2.11.17 and 2.12.8 released

## References

- [https://github.com/nats-io/nats-server/commit/8dcb26eaea78fdcbe96dbee5986d6019fd5cb94a](https://github.com/nats-io/nats-server/commit/8dcb26eaea78fdcbe96dbee5986d6019fd5cb94a)
- [https://github.com/nats-io/nats-server/commit/fc5fe39177533e9dbdd651d2458285bfae1dde27](https://github.com/nats-io/nats-server/commit/fc5fe39177533e9dbdd651d2458285bfae1dde27)
- [https://github.com/nats-io/nats-server/releases/tag/v2.11.17](https://github.com/nats-io/nats-server/releases/tag/v2.11.17)
- [https://github.com/nats-io/nats-server/releases/tag/v2.12.8](https://github.com/nats-io/nats-server/releases/tag/v2.12.8)
- [https://github.com/nats-io/nats-server/security/advisories/GHSA-3g5q-cfh2-cq67](https://github.com/nats-io/nats-server/security/advisories/GHSA-3g5q-cfh2-cq67)