CVE-2026-58213

EUVD-2026-42383

08.07.2026, 20:16

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.1 and 2.12.9, an MQTT client could include protocol control characters in subscription filters that were later forwarded as NATS protocol data to route or leafnode connections, corrupting the forwarded protocol stream and allowing injection of unintended NATS protocol operations. This issue is fixed in versions 2.14.1 and 2.12.9.

Injection

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.1 HIGH	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Debian Releases

Debian Product

Codename

nats-server

bookworm	vulnerable
forky	2.14.3-1 fixed
sid	2.14.3-1 fixed
trixie	vulnerable

Common Weakness Enumeration

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The software constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

References

https://github.com/nats-io/nats-server/commit/366837cfc65ab9ccb4f98193c65e8daf238582d8

https://github.com/nats-io/nats-server/commit/64ebae40051ee497c481e10f316238faf0de1736

https://github.com/nats-io/nats-server/commit/f14856b9e57a36818f43851cb69b6e33670885c9

https://github.com/nats-io/nats-server/pull/8163

https://github.com/nats-io/nats-server/pull/8164

https://github.com/nats-io/nats-server/releases/tag/v2.12.9

https://github.com/nats-io/nats-server/releases/tag/v2.14.1

https://github.com/nats-io/nats-server/security/advisories/GHSA-qrcv-3558-gj4f