CVE-2026-58208 PUBLISHED

NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled

Assigner: GitHub_M
Reserved: 29.06.2026 Published: 08.07.2026 Updated: 09.07.2026

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a WebSocket listener could route requests for the MQTT-over-WebSocket path into MQTT handling even when MQTT was not configured, allowing an unauthenticated client with access to the WebSocket listener to reach uninitialized MQTT state and crash the server process. This issue is fixed in versions 2.14.3 and 2.12.12.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS Score: 6.8

Product Status

Vendor nats-io
Product nats-server
Versions
  • Version >= 2.14.0-RC.1, < 2.14.3 is affected
  • Version < 2.12.12 is affected

References

Problem Types

  • CWE-248: Uncaught Exception CWE