Improper Neutralization of Special Elements in Output Used by a Downstream Component in nats-server - CVE-2026-58213
Published: June 30, 2026
Vulnerability identifier: #VU135933
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-58213
CWE-ID: CWE-74
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to inject unintended NATS protocol operations.
The vulnerability exists due to improper neutralization of special elements in MQTT subscription filters forwarded by route and leafnode connections when processing MQTT SUBSCRIBE requests. A remote user can send a specially crafted MQTT subscription filter to inject unintended NATS protocol operations.
Exploitation can affect forwarded protocol streams across cluster nodes or accounts where route, gateway, or leafnode connections are present.
Affected software
nats-server
How to mitigate CVE-2026-58213
Install security update from vendor's website.
nats-server - addressed in versions 2.12.9, 2.14.1