CVE Explorer

CVE-2026-58209

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured subscribe deny rule because these delivery paths did not consistently recheck the concrete original topic before sending the MQTT PUBLISH to the subscriber. This issue is fixed in versions 2.14.3 and 2.12.12.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:d2ac981d5d0ae491e8ac66354083877f3f77f0b037690914f2cb2a7e2ebb165d

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"nats-server","vendor":"nats-io","versions":[{"status":"affected","version":"< 2.12.12"},{"status":"affected","version":">= 2.14.0-RC.1, < 2.14.3"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:9929fc252ed17c29ce499a244afa3346cc59cbbb50815c14bf0e0c7bef6d2921 · sha256:f7c40974e5dbbeac… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:9929fc252ed17c29ce499a244afa3346cc59cbbb50815c14bf0e0c7bef6d2921 · sha256:f7c40974e5dbbeac… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-863","description":"CWE-863: Incorrect Authorization","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:9929fc252ed17c29ce499a244afa3346cc59cbbb50815c14bf0e0c7bef6d2921 · sha256:f7c40974e5dbbeac… · /containers/cna/problemTypes/0/descriptions/0

Source references

5 source assertions

{"name":"https://github.com/nats-io/nats-server/commit/181b1f51f40b9954c57e9d478e051fb257679356","tags":["x_refsource_MISC"],"url":"https://github.com/nats-io/nats-server/commit/181b1f51f40b9954c57e9d478e051fb257679356"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:9929fc252ed17c29ce499a244afa3346cc59cbbb50815c14bf0e0c7bef6d2921 · sha256:f7c40974e5dbbeac… · /containers/cna/references/1

{"name":"https://github.com/nats-io/nats-server/commit/1c429b6fdc5afd4188cc5faf1127f6334896cd87","tags":["x_refsource_MISC"],"url":"https://github.com/nats-io/nats-server/commit/1c429b6fdc5afd4188cc5faf1127f6334896cd87"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:9929fc252ed17c29ce499a244afa3346cc59cbbb50815c14bf0e0c7bef6d2921 · sha256:f7c40974e5dbbeac… · /containers/cna/references/2

{"name":"https://github.com/nats-io/nats-server/releases/tag/v2.12.12","tags":["x_refsource_MISC"],"url":"https://github.com/nats-io/nats-server/releases/tag/v2.12.12"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:9929fc252ed17c29ce499a244afa3346cc59cbbb50815c14bf0e0c7bef6d2921 · sha256:f7c40974e5dbbeac… · /containers/cna/references/3

{"name":"https://github.com/nats-io/nats-server/releases/tag/v2.14.3","tags":["x_refsource_MISC"],"url":"https://github.com/nats-io/nats-server/releases/tag/v2.14.3"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:9929fc252ed17c29ce499a244afa3346cc59cbbb50815c14bf0e0c7bef6d2921 · sha256:f7c40974e5dbbeac… · /containers/cna/references/4

{"name":"https://github.com/nats-io/nats-server/security/advisories/GHSA-7qmq-8cc4-hxwg","tags":["x_refsource_CONFIRM"],"url":"https://github.com/nats-io/nats-server/security/advisories/GHSA-7qmq-8cc4-hxwg"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:9929fc252ed17c29ce499a244afa3346cc59cbbb50815c14bf0e0c7bef6d2921 · sha256:f7c40974e5dbbeac… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer