---
id: CVE-2026-58254
title: >-
  NATS Server is a high-performance server for NATS.io, the cloud and edge
  native messaging system
summary: >-
  NATS Server is a high-performance server for NATS.io, the cloud and edge
  native messaging system. Prior to 2.14.3 and 2.12.8, message trace destination
  checks were applied to ordinary client connections but not consistently to
  messages a…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-863
vendor: linuxfoundation
product: nats-server
affected:
  - nats-server < 2.12.8
  - 'nats-server >= 2.14.0, < 2.14.3'
patched:
  - nats-server 2.14.3
published: '2026-07-08'
updated: '2026-07-13'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-58254'
references:
  - url: >-
      https://github.com/nats-io/nats-server/commit/cbe845932980b71563efac5cfa4cc751c88936cd
    label: security-advisories@github.com
  - url: 'https://github.com/nats-io/nats-server/releases/tag/v2.12.8'
    label: security-advisories@github.com
  - url: 'https://github.com/nats-io/nats-server/releases/tag/v2.14.3'
    label: security-advisories@github.com
  - url: >-
      https://github.com/nats-io/nats-server/security/advisories/GHSA-p3j5-5hrq-p75h
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00308
epssPercentile: 0.21076
ingestedAt: '2026-07-13T16:27:39.429Z'
---

## Overview

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.8, message trace destination checks were applied to ordinary client connections but not consistently to messages arriving through leafnode connections, allowing a leafnode operator to send trace events to subjects that would not otherwise be permitted and to use trace-only behavior to prevent normal delivery or storage of affected messages. This issue is fixed in versions 2.14.3 and 2.12.8.

## Affected

- `nats-server < 2.12.8`
- `nats-server >= 2.14.0, < 2.14.3`

## Remediation

Upgrade past the affected range:

- `nats-server 2.14.3`