CVE-2026-58254: NATS Server Incomplete Fix for Leaf Node Connection Permission Bypass
Summary
CVE-2026-58254: NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Affects nats across 2 version ranges.
< 2.12.8
>= 2.14.0, < 2.14.3
Fixed in 2.12.8 or 2.14.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NATS Server is a high-performance messaging system designed for cloud and edge applications. It facilitates communication between services and devices, enabling efficient data exchange. The server supports various messaging patterns and is known for its scalability and low latency. However, it has been found vulnerable to permission bypass issues, particularly concerning leaf node connections, which can compromise message integrity and security.
Vulnerability Detail
The vulnerability arises from an incomplete fix for CVE-2026-33249, where message trace destination checks were not consistently enforced for messages arriving through leaf node connections. This oversight allows a leaf node operator to send trace events to subjects that would typically be restricted. As a result, unauthorized access to sensitive data may occur, and normal message delivery or storage can be disrupted. The issue affects versions prior to 2.14.3 and 2.12.8.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.12.82.12.8 -
>= 2.14.0, < 2.14.32.14.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can restrict access to leaf node connections by implementing stricter permission checks in your application logic. However, this is not a substitute for applying the official patch.
Conclusion
In summary, CVE-2026-58254 represents a significant security vulnerability in NATS Server that allows unauthorized access through leaf node connections. It is crucial to update to the patched versions to mitigate the risks associated with this issue. Implementing temporary workarounds can provide some level of protection until the update is completed.
See every vulnerability recorded for nats →
FAQ
CVE-2026-58254 is a vulnerability in NATS Server that allows leaf node connections to bypass permission checks, potentially leading to unauthorized access to sensitive messages.
Versions prior to 2.14.3 and 2.12.8 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, implement stricter permission checks in your application as a temporary workaround.
More information about NATS Server can be found on the official NATS.io website, which provides documentation and resources for developers.
References
Related vulnerabilities
Recent vulnerabilities recorded for nats.
