CVE-2026-58213

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.1 and 2.12.9, an MQTT client could include protocol control characters in subscription filters that were later forwarded as NATS protocol data to route or leafnode connections, corrupting the forwarded protocol stream and allowing injection of unintended NATS protocol operations. This issue is fixed in versions 2.14.1 and 2.12.9.

• CWE-74

• https://github.com/nats-io/nats-server/commit/366837cfc65ab9ccb4f98193c65e8daf238582d8Patch
• https://github.com/nats-io/nats-server/commit/64ebae40051ee497c481e10f316238faf0de1736Patch
• https://github.com/nats-io/nats-server/commit/f14856b9e57a36818f43851cb69b6e33670885c9Patch
• https://github.com/nats-io/nats-server/pull/8163Issue Tracking, Patch
• https://github.com/nats-io/nats-server/pull/8164Issue Tracking, Patch
• https://github.com/nats-io/nats-server/releases/tag/v2.12.9Release Notes
• https://github.com/nats-io/nats-server/releases/tag/v2.14.1Release Notes
• https://github.com/nats-io/nats-server/security/advisories/GHSA-qrcv-3558-gj4fVendor Advisory

Published

Jul 8, 2026

Last Modified

Jul 13, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-58208NATS Server is a high-performance server for NATS.io, the cl…7.5
• CVE-2026-58209NATS Server is a high-performance server for NATS.io, the cl…4.3
• CVE-2026-5821The Image Optimizer plugin for WordPress is vulnerable to ar…8.1
• CVE-2026-58210NATS Server is a high-performance server for NATS.io, the cl…7.5
• CVE-2026-58211NATS Server is a high-performance server for NATS.io, the cl…5.4
• CVE-2026-58212Rejected reason: Further research determined the issue is no…
• CVE-2026-58214NATS Server is a high-performance server for NATS.io, the cl…4.3
• CVE-2026-58216An out-of-bounds read flaw was found in Samba's Kerberos Key…5.3
• CVE-2026-58218A flaw was found in Samba's internal DNS server where unauth…5.3
• CVE-2026-5822Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-58222A security flaw combining LDAP filter injection and improper…8.8
• CVE-2026-58225SQL Injection vulnerability in elixir-ecto postgrex allows a…2.1