CVE-2026-58207: NATS Server DOS Vulnerability

CVE-2026-58207 Overview

CVE-2026-58207 is an integer overflow vulnerability [CWE-190] in NATS Server, the high-performance messaging server for NATS.io used in cloud and edge-native messaging systems. The flaw exists in the Connz connection monitoring endpoint, where authenticated clients can supply crafted Offset and Limit pagination values that overflow internal arithmetic before bounds checking occurs. Successful exploitation crashes the NATS Server process, disrupting messaging for all connected clients and downstream services. The vulnerability affects all versions prior to 2.14.3 and 2.12.12.

Critical Impact
An authenticated client with account-scoped monitoring privileges can crash the NATS Server by submitting overflowing pagination values, resulting in a full denial of service across the messaging fabric.

Affected Products

NATS Server versions prior to 2.14.3
NATS Server versions prior to 2.12.12
Deployments exposing account-scoped connection monitoring (Connz/Subsz) endpoints

Discovery Timeline

2026-07-08 - CVE-2026-58207 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-58207

Vulnerability Analysis

The vulnerability resides in the pagination logic of the Connz (and related Subsz) monitoring handlers in server/monitor.go. The server accepts Offset and Limit parameters from authenticated clients requesting account-scoped connection listings. Prior to the fix, the server computed maxoff := c.Offset + c.Limit and then compared the result against the total client count. When either value approaches the maximum signed integer, the addition wraps around and produces a negative or otherwise invalid value.

The subsequent slice operations use this corrupted index, triggering an out-of-bounds runtime panic in Go. Because the panic occurs on the goroutine handling the monitoring request, it terminates the server process rather than being recovered.

Root Cause

The root cause is missing input validation and arithmetic overflow protection [CWE-190]. The server trusted client-supplied Offset and Limit values and performed unchecked addition before clamping. Sanity checks compared the sum against maxIndex only after the overflow had already occurred, defeating the intended bounds enforcement.

Attack Vector

Exploitation requires an authenticated client with permission to issue account-scoped monitoring requests over the network. The attacker sends a monitoring request containing large integer values for the Offset and Limit pagination parameters. No user interaction is required, and the impact scope changes because a single client can bring down the shared server, affecting all tenants and connected applications.

// Patch from server/monitor.go — sanitizes pagination bounds before use
// Before (vulnerable): unchecked Offset + Limit addition
//   minoff := c.Offset
//   maxoff := c.Offset + c.Limit   // integer overflow possible
//   maxIndex := totalClients
//   if minoff > maxIndex { minoff = maxIndex }
//   if maxoff > maxIndex { maxoff = maxIndex }

// After (fixed): clamp inputs before any arithmetic
maxIndex := totalClients
minoff := min(max(c.Offset, 0), maxIndex)
maxoff := minoff + min(c.Limit, maxIndex-minoff)

Source: nats-server commit 2ae0471 and nats-server commit 894d941. The fix clamps Offset to the valid range first, then bounds Limit against remaining capacity, eliminating the overflow window.

Detection Methods for CVE-2026-58207

Indicators of Compromise

Unexpected NATS Server process crashes or restarts coinciding with monitoring API traffic
Panic entries in NATS Server logs referencing slice bounds in monitor.go handlers
HTTP or system-account requests to Connz or Subsz endpoints containing unusually large offset or limit query parameters

Detection Strategies

Inspect NATS Server access and system logs for monitoring endpoint requests where offset or limit exceed reasonable operational values (for example, values near 2^31 or 2^63).
Alert on Go runtime panic stack traces mentioning Connz, Subsz, or pagination logic in server/monitor.go.
Correlate client authentication events with abnormal Connz request bursts followed by server restarts to identify the originating account.

Monitoring Recommendations

Track NATS Server availability and process uptime through infrastructure monitoring and alert on unplanned restarts.
Enable and forward NATS Server logs to a centralized logging platform for panic detection and query pattern analysis.
Baseline normal Connz/Subsz request parameters and flag statistical outliers in offset or limit values.

How to Mitigate CVE-2026-58207

Immediate Actions Required

Upgrade NATS Server to version 2.14.3 or 2.12.12, whichever aligns with your release branch.
Audit account and user permissions to restrict which clients may issue account-scoped monitoring requests.
Restrict network exposure of the monitoring HTTP port to trusted operator networks only.

Patch Information

The NATS maintainers released fixes in NATS Server v2.14.3 and NATS Server v2.12.12. The corrective commits 2ae0471 and 894d941 replace the unchecked Offset + Limit addition in server/monitor.go with clamped arithmetic using min/max guards. Full details are available in the GHSA-q59r-vq66-pxc2 advisory.

Workarounds

Remove or downgrade the $SYS account privileges for untrusted users so they cannot invoke Connz/Subsz monitoring endpoints.
Firewall the NATS Server HTTP monitoring port so only administrative hosts can reach it while patching is scheduled.
Place a reverse proxy in front of the monitoring endpoint that rejects requests with offset or limit values exceeding a reasonable ceiling.

bash

# Verify NATS Server version and confirm the patched release is deployed
nats-server --version
# Expected: nats-server: v2.14.3  (or v2.12.12)

# Example nats-server.conf hardening: bind monitoring to loopback only
http: "127.0.0.1:8222"

# Restrict system account access so only trusted operators can query Connz
system_account: SYS
accounts: {
  SYS: {
    users: [ { user: "admin", password: "$2a$..." } ]
  }
}