CVE-2026-58208: NATS Server WebSocket DOS Vulnerability

CVE-2026-58208 Overview

CVE-2026-58208 is a denial-of-service vulnerability in NATS Server, the high-performance messaging server for NATS.io used in cloud and edge native messaging deployments. Prior to versions 2.14.3 and 2.12.12, the WebSocket listener routes requests for the MQTT-over-WebSocket path into MQTT handling even when MQTT is not configured. An unauthenticated client with access to the WebSocket listener can reach uninitialized MQTT state and crash the server process. The issue is tracked under [CWE-248] Uncaught Exception and disclosed in GitHub Security Advisory GHSA-p957-7v2w-g93g.

Critical Impact
An unauthenticated remote attacker can crash the NATS Server process by sending a crafted MQTT-over-WebSocket upgrade request to a WebSocket listener where MQTT is not enabled.

Affected Products

NATS Server versions prior to 2.14.3
NATS Server versions prior to 2.12.12
Deployments exposing the WebSocket listener without MQTT configured

Discovery Timeline

2026-07-08 - CVE-2026-58208 published to NVD
2026-07-08 - Last updated in NVD database
2026-07-08 - Fixed releases v2.14.3 and v2.12.12 published on GitHub

Technical Details for CVE-2026-58208

Vulnerability Analysis

The vulnerability resides in the WebSocket upgrade path in server/websocket.go. NATS Server registers a /mqtt WebSocket endpoint on the WebSocket listener that dispatches incoming upgrade requests into the MQTT handling code. The dispatch executes regardless of whether MQTT is enabled through the server configuration. When MQTT is disabled, internal MQTT structures remain uninitialized. Processing a WebSocket upgrade for the /mqtt path then dereferences that uninitialized state, producing an uncaught runtime panic that terminates the server process.

The defect is classified as [CWE-248] Uncaught Exception. Because the crash occurs during upgrade handling, no authentication, subscription, or protocol negotiation is required to trigger it. A single HTTP request to the WebSocket listener is sufficient to abort the process.

Root Cause

The root cause is a missing precondition check in the WebSocket upgrade handler. The server accepts MQTT-over-WebSocket upgrades on the WebSocket listener but does not verify that MQTT is actually configured before invoking MQTT handling. The patch adds an explicit check for opts.MQTT.Port == 0 and rejects the upgrade with an HTTP 404 response when MQTT is not enabled.

Attack Vector

An unauthenticated remote attacker sends an HTTP WebSocket upgrade request to the NATS Server WebSocket listener targeting the /mqtt path. The server dispatches the request into MQTT handling, dereferences uninitialized MQTT state, and panics. The crash affects availability of all NATS messaging clients connected through that server instance.

	opts := s.getOpts()

+	// Reject MQTT-over-WebSocket upgrades unless MQTT is enabled.
+	if kind == MQTT && opts.MQTT.Port == 0 {
+		return nil, wsReturnHTTPError(w, r, http.StatusNotFound, "mqtt websocket endpoint not enabled")
+	}
+
	// From https://tools.ietf.org/html/rfc6455#section-4.2.1
	// Point 1.
	if r.Method != "GET" {

Source: GitHub Commit 73b3dd9 — this patch adds the missing guard that rejects MQTT WebSocket upgrades when the MQTT port is not configured.

Detection Methods for CVE-2026-58208

Indicators of Compromise

Unexpected NATS Server process termination or restart events without a corresponding administrative action.
HTTP requests to the WebSocket listener targeting the /mqtt upgrade path on deployments where MQTT is not configured.
Panic stack traces in NATS Server logs referencing MQTT handling code invoked from the WebSocket upgrade path.
Repeated client reconnection storms following abrupt server termination.

Detection Strategies

Inspect reverse proxy and load balancer access logs for WebSocket upgrade requests to /mqtt on NATS listeners.
Monitor NATS Server process supervisors (systemd, Kubernetes) for restart loops or non-zero exit codes.
Correlate WebSocket connection attempts with subsequent server crashes to identify triggering requests and source IP addresses.

Monitoring Recommendations

Enable structured logging on NATS Server and forward logs to a centralized analytics platform for anomaly detection.
Alert on Go runtime panic signatures in NATS Server output.
Track process uptime as a service-level indicator and alert on unexpected resets.

How to Mitigate CVE-2026-58208

Immediate Actions Required

Upgrade NATS Server to 2.14.3 or 2.12.12 immediately using the official GitHub Release v2.14.3 or GitHub Release v2.12.12.
Restrict network exposure of the WebSocket listener to trusted client networks until patching is complete.
Audit deployments to identify NATS Server instances where WebSocket is enabled but MQTT is not configured, as these are the vulnerable configurations.

Patch Information

The fix is delivered in NATS Server v2.14.3 and v2.12.12. The change, implemented in commits 73b3dd9 and 837536b, rejects MQTT-over-WebSocket upgrades with an HTTP 404 response when opts.MQTT.Port == 0. Full details are available in GitHub Security Advisory GHSA-p957-7v2w-g93g.

Workarounds

Disable the WebSocket listener until an upgrade to a patched version is possible.
Place a reverse proxy in front of NATS Server that blocks requests to the /mqtt WebSocket path when MQTT is not in use.
Restrict WebSocket listener access to authenticated clients using network-layer controls such as mutual TLS or IP allowlists.

bash

# Verify NATS Server version and upgrade to a patched release
nats-server --version
# Expected output: nats-server: v2.14.3 or v2.12.12 (or later)

# Example: pull patched container image
docker pull nats:2.14.3

# Example nginx rule to block /mqtt upgrades when MQTT is not used
# location /mqtt { return 404; }