PT-2026-56563 · Nats.Io · Nats Server

Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-58250

NVD

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.12.8 and 2.11.17, an unauthenticated peer with network access to a leafnode listener with compression enabled could crash the server during the pre-authentication leafnode handshake by sending repeated leafnode INFO protocol messages before authentication and account setup completed. This issue is fixed in versions 2.12.8 and 2.11.17.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-58250

Affected Products

Nats Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-58250 · Security Note
• https://github.com/nats-io/nats-server/releases/tag/v2.12.8 · Note
• https://github.com/nats-io/nats-server/commit/8dcb26eaea78fdcbe96dbee5986d6019fd5cb94a · Note
• https://github.com/nats-io/nats-server/commit/fc5fe39177533e9dbdd651d2458285bfae1dde27 · Note
• https://github.com/nats-io/nats-server/security/advisories/GHSA-3g5q-cfh2-cq67 · Note
• https://github.com/nats-io/nats-server/releases/tag/v2.11.17 · Note