CVE-2026-58209

Published: Jul 8, 2026Modified: Jul 13, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured subscribe deny rule because these delivery paths did not consistently recheck the concrete original topic before sending the MQTT PUBLISH to the subscriber. This issue is fixed in versions 2.14.3 and 2.12.12.

Affected (2)

Products: Linuxfoundation: Nats Server

Linuxfoundation

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Linuxfoundation Nats Server	Before 2.12.12
Linuxfoundation Nats Server	From 2.14.0 to 2.14.3

Related CWEs

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (5)

https://github.com/nats-io/nats-server/commit/181b1f51f40b9954c57e9d478e051fb257679356

Source: security-advisories@github.com

Patch

https://github.com/nats-io/nats-server/commit/1c429b6fdc5afd4188cc5faf1127f6334896cd87

Source: security-advisories@github.com

Patch

https://github.com/nats-io/nats-server/releases/tag/v2.12.12

Source: security-advisories@github.com

Release Notes

https://github.com/nats-io/nats-server/releases/tag/v2.14.3

Source: security-advisories@github.com

Release Notes

https://github.com/nats-io/nats-server/security/advisories/GHSA-7qmq-8cc4-hxwg

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.