CVE-2026-58209

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured subscribe deny rule because these delivery paths did not consistently recheck the concrete original topic before sending the MQTT PUBLISH to the subscriber. This issue is fixed in versions 2.14.3 and 2.12.12.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/nats-io/nats-server/commit/181b1f51f40b9954c57e9d478e051fb257679356	Patch
https://github.com/nats-io/nats-server/commit/1c429b6fdc5afd4188cc5faf1127f6334896cd87	Patch
https://github.com/nats-io/nats-server/releases/tag/v2.12.12	Release Notes
https://github.com/nats-io/nats-server/releases/tag/v2.14.3	Release Notes
https://github.com/nats-io/nats-server/security/advisories/GHSA-7qmq-8cc4-hxwg	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:linuxfoundation:nats-server::::::::
	cpe:2.3:a:linuxfoundation:nats-server::::::::

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) NATS Server es un servidor de alto rendimiento para NATS.io, el sistema de mensajería nativo de la nube y del borde. Antes de 2.14.3 y 2.12.12, la entrega de mensajes retenidos de MQTT y la reproducción duradera QoS1+ podían entregar mensajes cuyos temas originales coincidían con una regla de denegación de suscripción configurada por el suscriptor porque estas rutas de entrega no volvían a verificar consistentemente el tema original concreto antes de enviar el MQTT PUBLISH al suscriptor. Este problema está solucionado en las versiones 2.14.3 y 2.12.12.

Information

Published : 2026-07-08 20:16

Updated : 2026-10-25 17:10

NVD link : CVE-2026-58209

Mitre link : CVE-2026-58209

CVE.ORG link : CVE-2026-58209

JSON object : View

Products Affected

linuxfoundation

nats-server

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-58209", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58209", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T13:30:43.243356Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nats-io", "product": "nats-server", "versions": [{"status": "affected", "version": "< 2.12.12"}, {"status": "affected", "version": ">= 2.14.0-RC.1, < 2.14.3"}]}]}], "published": "2026-07-08T20:16:53.800", "references": [{"url": "https://github.com/nats-io/nats-server/commit/181b1f51f40b9954c57e9d478e051fb257679356", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nats-io/nats-server/commit/1c429b6fdc5afd4188cc5faf1127f6334896cd87", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nats-io/nats-server/releases/tag/v2.12.12", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nats-io/nats-server/releases/tag/v2.14.3", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-7qmq-8cc4-hxwg", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured subscribe deny rule because these delivery paths did not consistently recheck the concrete original topic before sending the MQTT PUBLISH to the subscriber. This issue is fixed in versions 2.14.3 and 2.12.12."}, {"lang": "es", "value": "NATS Server es un servidor de alto rendimiento para NATS.io, el sistema de mensajer\u00eda nativo de la nube y del borde. Antes de 2.14.3 y 2.12.12, la entrega de mensajes retenidos de MQTT y la reproducci\u00f3n duradera QoS1+ pod\u00edan entregar mensajes cuyos temas originales coincid\u00edan con una regla de denegaci\u00f3n de suscripci\u00f3n configurada por el suscriptor porque estas rutas de entrega no volv\u00edan a verificar consistentemente el tema original concreto antes de enviar el MQTT PUBLISH al suscriptor. Este problema est\u00e1 solucionado en las versiones 2.14.3 y 2.12.12."}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3662387F-C5A6-478A-94D1-849E3C7E81DB", "versionEndExcluding": "2.12.12"}, {"criteria": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9BF70729-64AF-4219-BC35-3C5C042F0595", "versionEndExcluding": "2.14.3", "versionStartIncluding": "2.14.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}