---
id: CVE-2026-58210
title: >-
  NATS Server is a high-performance server for NATS.io, the cloud and edge
  native messaging system
summary: >-
  NATS Server is a high-performance server for NATS.io, the cloud and edge
  native messaging system. Prior to 2.14.3 and 2.12.12, an unauthenticated MQTT
  client could cause the server to retain large incomplete MQTT CONNECT packets
  before a…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-400
vendor: linuxfoundation
product: nats-server
affected:
  - nats-server < 2.12.12
  - 'nats-server >= 2.14.0, < 2.14.3'
patched:
  - nats-server 2.14.3
published: '2026-07-08'
updated: '2026-07-13'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-58210'
references:
  - url: >-
      https://github.com/nats-io/nats-server/commit/bce9ef39469e610aeddb819194ceb7f7edfc0861
    label: security-advisories@github.com
  - url: >-
      https://github.com/nats-io/nats-server/commit/e016e47bbf70304945f2ae9dc397e4862adefaf5
    label: security-advisories@github.com
  - url: 'https://github.com/nats-io/nats-server/releases/tag/v2.12.12'
    label: security-advisories@github.com
  - url: 'https://github.com/nats-io/nats-server/releases/tag/v2.14.3'
    label: security-advisories@github.com
  - url: >-
      https://github.com/nats-io/nats-server/security/advisories/GHSA-r72h-j7qq-v6qg
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00742
epssPercentile: 0.52763
ingestedAt: '2026-07-13T15:27:34.209Z'
---

## Overview

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an unauthenticated MQTT client could cause the server to retain large incomplete MQTT CONNECT packets before authentication completed, consuming server memory while the parser waited for the advertised MQTT packet length. This issue is fixed in versions 2.14.3 and 2.12.12.

## Affected

- `nats-server < 2.12.12`
- `nats-server >= 2.14.0, < 2.14.3`

## Remediation

Upgrade past the affected range:

- `nats-server 2.14.3`