PT-2026-56561

CVE-2026-58213

Published

2026-07-08

Updated

2026-07-14

Description by

CVSS 3.1

7.1

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions NATS Server versions prior to 2.14.1 NATS Server versions prior to 2.12.9

Description An MQTT client can include protocol control characters in subscription filters. These characters are subsequently forwarded as NATS protocol data to route or leafnode connections, which corrupts the forwarded protocol stream and enables the injection of unintended NATS protocol operations.

Recommendations Update NATS Server to version 2.14.1 or later. Update NATS Server to version 2.12.9 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Thesecguy45

Vendors

Affected products

Weakness enumeration

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

Related identifiers