vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-58250

NATS Server: Pre-auth server crash via double INFO in leafnode handshake

HIGH
7.5
CVSS Score
Published: July 8, 2026 at 07:48 PM UTC
Updated: October 25, 2026 at 05:10 PM UTC
2 products affected across 2 vendorsNats ServerNats Server

Using nats-server by nats-io?

Get instant alerts when new vulnerabilities affect nats-server - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.5
Exploit prediction
EPSS 0.7%
SSVC
No known exploit

Description

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.12.8 and 2.11.17, an unauthenticated peer with network access to a leafnode listener with compression enabled could crash the server during the pre-authentication leafnode handshake by sending repeated leafnode INFO protocol messages before authentication and account setup completed. This issue is fixed in versions 2.12.8 and 2.11.17.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Nats Server· Linuxfoundation
95%
All versionsv < 2.11.172.12.0 ≤ v < 2.12.8
Affected range stops below 2.11.17, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.12.8, so it looks safe — our inference, not a vendor statement
Nats Server· Nats Io
90%
v < 2.11.17
Affected range stops below 2.11.17, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.12.8, so it looks safe — our inference, not a vendor statement

References (5)

x_refsource_CONFIRMVendor Advisory
Source: cverecord
https://github.com/nats-io/nats-server/security/advisories/GHSA-3g5q-cfh2-cq67
x_refsource_MISCPatch
Source: cverecord
https://github.com/nats-io/nats-server/commit/8dcb26eaea78fdcbe96dbee5986d6019fd5cb94a
x_refsource_MISCPatch
Source: cverecord
https://github.com/nats-io/nats-server/commit/fc5fe39177533e9dbdd651d2458285bfae1dde27
x_refsource_MISCRelease Notes
Source: cverecord
https://github.com/nats-io/nats-server/releases/tag/v2.11.17
x_refsource_MISCRelease Notes
Source: cverecord
https://github.com/nats-io/nats-server/releases/tag/v2.12.8

SSVC — Action Prioritization

SSVCNo known exploitAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.5HIGHGitHub_M
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-476

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card