Skip to content
Heist/ feed
Back to feed
High

NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory

Type: advisorySources: OSV

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an unauthenticated MQTT client could cause the server to retain large incomplete MQTT CONNECT packets before authentication completed, consuming server memory while the parser waited for the advertised MQTT packet length. This issue is fixed in versions 2.14.3 and 2.12.12.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-58210
Confirmed fixed CVEs
Not specified
Updated in this feed
6 Nov 2026, 01:28 UTC · Revision 1

Source evidence

NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory

core-osv · Original source

Published 8 Jul 2026, 20:13 UTC

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an unauthenticated MQTT client could cause the server to retain large incomplete MQTT CONNECT packets before authentication completed, consuming server memory while the parser waited for the advertised MQTT packet length. This issue is fixed in versions 2.14.3 and 2.12.12.

osv:CVE-2026-58210
Complete source record
{
  "id": "e304f2cfc8e66e947c94eb6a8dc178656531915b4116b3e1485113c641301d96",
  "url": "https://osv.dev/vulnerability/CVE-2026-58210",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory",
    "summary": "NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an unauthenticated MQTT client could cause the server to retain large incomplete MQTT CONNECT packets before authentication completed, consuming server memory while the parser waited for the advertised MQTT packet length. This issue is fixed in versions 2.14.3 and 2.12.12.",
    "evidence": "osv:CVE-2026-58210",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-58210",
      "aliases": [
        "BIT-nats-2026-58210",
        "CVE-2026-58210",
        "GHSA-r72h-j7qq-v6qg"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/nats-io/nats-server",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "e8de2a67c7a094abca6013931ecf6cbff4b3fb02"
                },
                {
                  "introduced": "0cbd01caf8f29011c26273ff7662addd3830396a"
                },
                {
                  "fixed": "9b17a586be69c9ff36e4c84a421ca47da410b561"
                },
                {
                  "fixed": "bce9ef39469e610aeddb819194ceb7f7edfc0861"
                },
                {
                  "fixed": "e016e47bbf70304945f2ae9dc397e4862adefaf5"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2.12.12"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "2.14.0"
                      },
                      {
                        "fixed": "2.14.3"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "bce9ef39469e610aeddb819194ceb7f7edfc0861"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "e016e47bbf70304945f2ae9dc397e4862adefaf5"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "e8de2a67c7a094abca6013931ecf6cbff4b3fb02"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v2.12.12"
                  },
                  {
                    "range": [
                      {
                        "fixed": "9b17a586be69c9ff36e4c84a421ca47da410b561"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v2.14.3"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v2.14.2",
            "v2.12.11",
            "v2.12.10",
            "v2.12.10-RC.1",
            "v2.14.2-RC.1",
            "v2.14.1",
            "v2.12.9",
            "v2.14.1-RC.2",
            "v2.12.9-RC.2",
            "v2.14.1-RC.1",
            "v2.12.9-RC.1",
            "v2.12.8",
            "v2.14.0",
            "v2.12.7",
            "v2.12.4",
            "v2.12.6",
            "v2.12.5",
            "v2.12.5-RC.2",
            "v2.12.5-RC.1",
            "v2.12.4-RC.6",
            "v2.12.4-RC.5",
            "v2.12.4-RC.4",
            "v2.12.2",
            "v2.12.4-RC.3",
            "v2.12.4-RC.2",
            "v2.12.4-RC.1",
            "v2.12.3",
            "v2.12.3-RC.5",
            "v2.12.3-RC.4",
            "v2.12.3-RC.3",
            "v2.12.3-RC.2",
            "v2.12.3-RC.1",
            "v2.12.2-RC.4",
            "v2.12.2-RC.3",
            "v2.12.1",
            "v2.12.2-RC.2",
            "v2.12.2-RC.1",
            "v2.12.0",
            "v2.12.1-RC.5",
            "v2.12.1-RC.4",
            "v2.12.1-RC.3",
            "v2.12.1-RC.2",
            "v2.12.1-RC.1",
            "v2.12.0-RC.6",
            "v2.12.0-RC.5",
            "v2.12.0-RC.4",
            "v2.12.0-RC.3",
            "v2.12.0-RC.2",
            "v2.12.0-RC.1",
            "v2.12.0-preview.2",
            "v2.12.0-preview.1",
            "v2.11.3",
            "v2.11.3-RC.2",
            "v2.11.3-RC.1",
            "v2.11.2",
            "v2.11.2-RC.3",
            "v2.11.2-RC.2",
            "v2.11.2-RC.1",
            "v2.11.0",
            "v2.11.0-RC.5",
            "v2.11.0-RC.4",
            "v2.11.0-RC.3",
            "v2.11.0-RC.2",
            "v2.11.0-RC.1",
            "v2.10.3",
            "v2.10.2",
            "v2.10.1",
            "v2.10.0",
            "v2.9.22",
            "v2.9.21",
            "v2.9.20",
            "v2.9.19",
            "v2.9.18",
            "v2.9.17",
            "v2.9.16",
            "v2.9.15",
            "v2.9.14",
            "v2.9.12",
            "v2.9.11",
            "v2.9.10",
            "v2.9.9",
            "v2.9.8",
            "v2.9.7",
            "v2.9.6",
            "v2.9.5",
            "v2.9.4",
            "v2.9.3",
            "v2.9.2",
            "v2.9.1",
            "v2.9.0",
            "v2.8.4",
            "v2.8.3",
            "v2.8.2",
            "v2.8.1",
            "v2.8.0",
            "v2.7.4",
            "v2.7.3",
            "v2.7.2",
            "v2.7.1",
            "v2.7.0",
            "v2.7.0-rc2",
            "v2.7.0-rc1",
            "v2.6.6",
            "v2.6.5",
            "v2.6.4",
            "v2.6.3",
            "v2.6.2",
            "v2.6.1",
            "v2.6.0",
            "v2.5.0",
            "v2.4.0",
            "v2.3.4",
            "v2.3.3",
            "v2.3.2",
            "v2.3.1",
            "v2.3.0",
            "v2.2.6",
            "v2.2.5",
            "v2.2.4",
            "v2.2.3",
            "v2.2.2",
            "v2.2.1",
            "v2.2.0",
            "v2.1.7",
            "v2.1.6",
            "v2.1.4",
            "v2.1.2",
            "v2.1.0",
            "v2.0.4",
            "v2.0.2",
            "v2.0.0",
            "v2.0.0-RC19",
            "v2.0.0-RC14",
            "v1.3.0",
            "v1.2.0",
            "v1.1.0",
            "v1.0.6",
            "v1.0.4",
            "v1.0.2",
            "v1.0.0",
            "v0.9.6",
            "v0.9.4",
            "v0.9.2",
            "v0.8.1",
            "v0.8.0",
            "v0.7.2",
            "v0.7.0",
            "v0.6.8",
            "v0.6.6",
            "v0.6.4",
            "v0.6.2",
            "v0.6.0",
            "v0.5.6",
            "v0.5.4",
            "v0.5.2",
            "v0.5.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58210.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:45.645948081Z",
      "provider": "osv",
      "references": [
        "https://github.com/nats-io/nats-server/releases/tag/v2.12.12",
        "https://github.com/nats-io/nats-server/releases/tag/v2.14.3",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58210.json",
        "https://github.com/nats-io/nats-server/security/advisories/GHSA-r72h-j7qq-v6qg",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-58210",
        "https://github.com/nats-io/nats-server/commit/bce9ef39469e610aeddb819194ceb7f7edfc0861",
        "https://github.com/nats-io/nats-server/commit/e016e47bbf70304945f2ae9dc397e4862adefaf5"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-400"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58210.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-58210",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 513864,
  "published_at": "2026-07-08T20:13:37.082+00:00"
}