CVE-2026-58253

Name of the Vulnerable Software and Affected Versions NATS Server versions prior to 2.14.0 NATS Server versions prior to 2.12.7 NATS Server versions prior to 2.11.16

Description When no auth user is configured, a parser fast path designed for standard client connections may incorrectly apply to route or leafnode listeners. This allows an unauthenticated peer to bypass inter-server CONNECT authentication and gain privileges associated with that connection type.

Recommendations Update to version 2.14.0 or later. Update to version 2.12.7 or later. Update to version 2.11.16 or later.