CVE-2026-58207: NATS Server Denial-of-Service via Integer Overflow in Pagination

Technical summary

CVE-2026-58207 is an integer overflow vulnerability (CWE-190) in NATS Server's Connz (connection statistics) monitoring endpoint. When a client with account-scoped connection monitoring permissions sends a request with large Offset and Limit values, the server fails to safely bound the response window before performing arithmetic operations. The unchecked integer overflow corrupts internal state or triggers an exception, causing the server process to terminate. The vulnerability requires an authenticated connection to the NATS cluster, limiting exposure to users or services with valid credentials.

Business impact

Organizations relying on NATS Server for mission-critical messaging may face unexpected service interruptions. An authenticated user—whether an insider or someone with compromised credentials—can unilaterally crash the messaging broker, affecting all downstream applications that depend on it. In microservices architectures, IoT platforms, and edge computing environments, such outages cascade quickly. Recovery requires manual server restart, introducing operational overhead and potential data loss if in-flight messages are not persisted. For systems handling time-sensitive operations (trading, real-time alerts, autonomous systems), even brief outages carry material risk.

Affected systems

NATS Server versions prior to 2.14.3 (all 2.14.x before .3) and prior to 2.12.12 (all 2.12.x before .12) are vulnerable. Organizations running earlier minor versions (e.g., 2.13.x, 2.11.x, or older) are also at risk; verify your exact version and apply the nearest available patch. Patch eligibility depends on your current release line; consult the NATS project's advisory for end-of-life and support timelines.

Exploitability

Exploitation requires a valid, authenticated connection to the NATS cluster. An attacker cannot exploit this vulnerability from the internet without first obtaining legitimate credentials or compromising an existing client. However, inside a zero-trust or hybrid cloud environment where many internal services connect to NATS, the barrier is lower. Once authenticated, triggering the crash is trivial—a single malformed Connz request suffices. No user interaction or complex setup is needed. The CVSS 7.7 (HIGH) score reflects the high availability impact combined with the authentication prerequisite.

Remediation

Upgrade NATS Server to version 2.14.3 or later (if running 2.14.x), or 2.12.12 or later (if running 2.12.x). Review your version's release notes to confirm the fix is included. If you run an older minor version, determine the correct upgrade path from the NATS project documentation. Plan for a brief maintenance window, as upgrades typically require server restart. Test the upgrade in a staging environment first, especially if you have custom monitoring or integrations relying on the Connz endpoint.

Patch guidance

Prioritize patching production clusters immediately, given the ease of exploitation by internal users or compromised services. The patch is available now; delay carries unacceptable risk. For 2.14.x users: upgrade to 2.14.3+. For 2.12.x users: upgrade to 2.12.12+. For users on other supported branches, check the NATS release notes to identify the corresponding patched version. Rolling restarts are often possible in clustered deployments to minimize downtime. Verify patch application by checking the server version string and reviewing logs for successful startup.

Detection guidance

Monitor NATS server logs and metrics for unexpected crashes or restarts. A sudden termination without scheduled maintenance is suspicious. If possible, enable Connz request logging or middleware inspection to flag unusually large pagination parameters (extremely high Offset or Limit values). Network-based detection is difficult; focus on behavioral signals: frequent server restarts, application errors due to lost NATS connections, or alerts from monitoring systems that connect via Connz. After patching, baseline normal behavior to ease future anomaly detection.

Why prioritize this

This vulnerability merits immediate attention. Authentication requirement prevents external mass exploitation, but internal threats—disgruntled employees, compromised microservices, or lateral-movement attackers already on your network—can weaponize it instantly to disrupt critical infrastructure. The fix is available, tested, and simple to deploy. Any delay increases operational risk disproportionately.

Risk score, explained

CVSS 7.7 (HIGH) reflects a complete denial-of-service impact (Availability: High) with limited scope (authentication required). The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H indicates network accessibility, low attack complexity, low privilege requirement (authenticated user), no user interaction, and scope change (the crash affects all users). The score is justified: while confidentiality and integrity are unharmed, availability loss is total and easily triggered.

Frequently asked questions