CVE-2026-58208: NATS Server WebSocket Denial-of-Service Vulnerability

Technical summary

The vulnerability exists in the NATS Server WebSocket listener's request routing logic. When a WebSocket connection arrives with an MQTT-over-WebSocket path pattern, the listener forwards the request to MQTT handling code paths without first verifying whether MQTT has been configured and initialized on the server. If MQTT is disabled or unconfigured, the handler attempts to access uninitialized state, triggering a crash. The root cause is improper input validation and state verification before dispatching to protocol-specific handlers. CWE-248 (Uncaught Exception) applies because the crash stems from accessing uninitialized resources without proper exception handling or pre-flight checks.

Business impact

For organizations relying on NATS Server as a critical messaging backbone in cloud-native or edge environments, this vulnerability creates a denial-of-service risk. An unauthenticated attacker can remotely crash the server without authentication, disrupting all connected services and causing message delivery failures. In production environments where NATS coordinates microservices, IoT gateways, or event streaming, unexpected downtime can cascade across dependent systems. Recovery requires manual server restart and may trigger cascading failures in dependent applications.

Affected systems

NATS Server versions prior to 2.14.3 and prior to 2.12.12 are affected. The vulnerability is exposed only when a WebSocket listener is configured and accessible to untrusted networks. Servers with MQTT explicitly disabled but WebSocket enabled remain vulnerable. Systems that have already upgraded to 2.14.3 or 2.12.12 are not affected.

Exploitability

Exploitation is relatively straightforward: an attacker with network access to the WebSocket listener can send an MQTT-over-WebSocket request without authentication to trigger the crash. The CVSS score of 6.8 (Medium) reflects the network accessibility (AV:N), the requirement for specific conditions such as an exposed WebSocket listener and MQTT being disabled (AC:H), and the impact limited to availability (A:H). No authentication is required (PR:N), but the attack requires knowledge of the deployment configuration and network reachability to the listener port.

Remediation

Organizations should upgrade to NATS Server 2.14.3 or 2.12.12 as soon as possible. Consult the official NATS release notes and vendor advisory to verify the exact version applicable to your deployment branch. As a temporary mitigation prior to patching, restrict network access to the WebSocket listener using firewall rules or network segmentation, ensuring only trusted clients can reach the listener port. Consider disabling the WebSocket listener entirely if it is not required for your use case.

Patch guidance

Upgrade NATS Server to version 2.14.3 (for the 2.14.x branch) or 2.12.12 (for the 2.12.x branch) or later. Verify with the official Linux Foundation NATS project release notes that your deployment branch is covered by these fixed versions. If you are running a version older than 2.12.x, consult the vendor advisory to determine if a backport or extended support is available. After patching, perform a controlled restart of the server to activate the fix, and verify connectivity from dependent services.

Detection guidance

Monitor NATS Server logs for unexpected crashes or restarts that coincide with WebSocket connection attempts. Implement network monitoring to detect unusual WebSocket traffic patterns targeting MQTT paths on NATS listener ports. A sudden spike in WebSocket connections followed by server restart may indicate an exploitation attempt. Additionally, review server configuration to identify instances where WebSocket is enabled but MQTT is disabled—these are the most vulnerable configurations. Enable verbose logging on the WebSocket listener if available to capture request patterns before crashes.

Why prioritize this

This vulnerability warrants prompt but not emergency patching. While it requires network access and the target is an unauthenticated attacker, the denial-of-service impact on a critical messaging component makes it operationally significant. Organizations should prioritize this vulnerability in the context of their NATS deployment's criticality to their architecture. If NATS is a dependency for time-sensitive or mission-critical services (e.g., IoT command/control, real-time event processing), elevation of priority is justified. For test or non-critical deployments, standard patching cycles are acceptable.

Risk score, explained

The CVSS 6.8 (Medium) score reflects a networked, unauthenticated attack vector with the ability to completely deny service to the NATS Server component. The score is moderated by the requirement for a specific configuration (WebSocket enabled, MQTT disabled or unconfigured) and reachability to the listener, which may not be exposed on all deployments. The impact is strictly availability—no confidentiality or integrity loss occurs. Organizations with exposed NATS WebSocket listeners in untrusted networks should treat this as higher priority; those with network segmentation or limited exposure can follow standard patching cycles.

Frequently asked questions