---
id: CVE-2026-58209
title: >-
  NATS Server is a high-performance server for NATS.io, the cloud and edge
  native messaging system
summary: >-
  NATS Server is a high-performance server for NATS.io, the cloud and edge
  native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message
  delivery and QoS1+ durable replay could deliver messages whose original topics
  matched a…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-863
vendor: linuxfoundation
product: nats-server
affected:
  - nats-server < 2.12.12
  - 'nats-server >= 2.14.0, < 2.14.3'
patched:
  - nats-server 2.14.3
published: '2026-07-08'
updated: '2026-07-13'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-58209'
references:
  - url: >-
      https://github.com/nats-io/nats-server/commit/181b1f51f40b9954c57e9d478e051fb257679356
    label: security-advisories@github.com
  - url: >-
      https://github.com/nats-io/nats-server/commit/1c429b6fdc5afd4188cc5faf1127f6334896cd87
    label: security-advisories@github.com
  - url: 'https://github.com/nats-io/nats-server/releases/tag/v2.12.12'
    label: security-advisories@github.com
  - url: 'https://github.com/nats-io/nats-server/releases/tag/v2.14.3'
    label: security-advisories@github.com
  - url: >-
      https://github.com/nats-io/nats-server/security/advisories/GHSA-7qmq-8cc4-hxwg
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00342
epssPercentile: 0.24944
ingestedAt: '2026-07-13T14:27:26.856Z'
---

## Overview

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured subscribe deny rule because these delivery paths did not consistently recheck the concrete original topic before sending the MQTT PUBLISH to the subscriber. This issue is fixed in versions 2.14.3 and 2.12.12.

## Affected

- `nats-server < 2.12.12`
- `nats-server >= 2.14.0, < 2.14.3`

## Remediation

Upgrade past the affected range:

- `nats-server 2.14.3`