CVE-2026-58214

Name of the Vulnerable Software and Affected Versions NATS Server versions prior to 2.14.3 NATS Server versions prior to 2.12.12

Description An authenticated MQTT client can subscribe to the internal $MQTT.deliver.pubrel subject family. This action allows the client to bypass configured subscribe permissions and expose MQTT QoS2 protocol metadata for sessions within the account. QoS2 (Quality of Service level 2) is a protocol mechanism that ensures a message is delivered exactly once.

Recommendations Update NATS Server to version 2.14.3 or later. Update NATS Server to version 2.12.12 or later.