CVE-2026-58213: NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.1 and 2.12.9, an MQTT client could include protocol control characters in subscription filters that were later forwarded as NATS protocol data to route or leafnode connections, corrupting the forwarded protocol stream and allowing injection of unintended NATS protocol operations. This issue is fixed in versions 2.14.1 and 2.12.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nats-serverto a version that resolves this vulnerability.Fixed in 2.14.1 - Upgrade
Upgrade
nats-serverto a version that resolves this vulnerability.Fixed in 2.12.9
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58213?
CVE-2026-58213 has a high severity rating of 7.1.
How do I fix CVE-2026-58213?
To mitigate CVE-2026-58213, upgrade to NATS Server versions 2.14.1 or 2.12.9 and later.
What vulnerability does CVE-2026-58213 address?
CVE-2026-58213 addresses a protocol injection issue in the MQTT SUBSCRIBE mechanism of NATS Server.
What are the potential impacts of CVE-2026-58213?
CVE-2026-58213 can allow arbitrary NATS command injection via corrupted subscription filters.
In which versions is CVE-2026-58213 present?
CVE-2026-58213 affects NATS Server versions prior to 2.14.1 and 2.12.9.