Back
CVE-2026-58209
NATS Server: MQTT retained and QoS replay bypass subscribe deny filters
Medium4.3EPSS 0.34%
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured subscribe deny rule because these delivery paths did not consistently recheck the concrete original topic before sending the MQTT PUBLISH to the subscriber. This issue is fixed in versions 2.14.3 and 2.12.12.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | Medium4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVDNVD · Analyzed | 3.1 | Medium4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.34% · top 72% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.
Weakness
Affected products
- affected < 2.12.12
- affected >= 2.14.0-RC.1, < 2.14.3
References (5)
- https://github.com/nats-io/nats-server/security/advisories/GHSA-7qmq-8cc4-hxwg (opens in a new tab)x_refsource_CONFIRM
- https://github.com/nats-io/nats-server/commit/181b1f51f40b9954c57e9d478e051fb257679356 (opens in a new tab)x_refsource_MISC
- https://github.com/nats-io/nats-server/commit/1c429b6fdc5afd4188cc5faf1127f6334896cd87 (opens in a new tab)x_refsource_MISC
- https://github.com/nats-io/nats-server/releases/tag/v2.12.12 (opens in a new tab)x_refsource_MISC
- https://github.com/nats-io/nats-server/releases/tag/v2.14.3 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-58209)Record last updated .