CVE-2026-58210: NATS Server MQTT DoS Vulnerability

CVE-2026-58210 Overview

CVE-2026-58210 is a resource exhaustion vulnerability [CWE-400] in NATS Server, a high-performance messaging server for NATS.io used in cloud and edge native environments. Prior to versions 2.14.3 and 2.12.12, an unauthenticated MQTT client can cause the server to retain large incomplete MQTT CONNECT packets before authentication completes. The server allocates memory based on the attacker-controlled MQTT packet length field while waiting for the remainder of the packet. Attackers can exploit this over the network without credentials or user interaction to exhaust server memory.

Critical Impact
Unauthenticated attackers can trigger denial of service by forcing the NATS Server to buffer oversized MQTT CONNECT payloads before authentication, exhausting available memory.

Affected Products

NATS Server versions prior to 2.12.12 (2.12.x branch)
NATS Server versions prior to 2.14.3 (2.14.x branch)
Deployments exposing the MQTT listener to untrusted networks

Discovery Timeline

2026-07-08 - CVE-2026-58210 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-58210

Vulnerability Analysis

The vulnerability resides in the MQTT protocol parser inside server/mqtt.go. When the NATS Server receives an MQTT CONNECT packet, the parser reads the advertised remaining-length field and buffers incoming bytes until the full packet arrives. Before this fix, no upper bound was enforced on the packet length during the pre-authentication phase.

An attacker can open a TCP connection to the MQTT listener and send a partial CONNECT packet declaring a very large remaining length. The server allocates a buffer sized to the attacker's declaration and holds it while awaiting the rest of the payload. Repeating this across many connections consumes server memory and can crash the process, denying service to legitimate clients. The issue maps to [CWE-400] Uncontrolled Resource Consumption.

Root Cause

The readPacketLen() function did not accept a maximum length parameter. Any client, including unauthenticated ones, could declare an arbitrarily large packet size. The server trusted this length and reserved memory before verifying client identity or applying payload limits.

Attack Vector

Exploitation requires network access to the NATS Server MQTT port. The attacker sends crafted MQTT CONNECT packets with inflated remaining-length values but withholds the full payload. No authentication or user interaction is required. Multiple concurrent connections amplify memory pressure until the process becomes unresponsive or terminates.

// Patch excerpt from server/mqtt.go
// Source: https://github.com/nats-io/nats-server/commit/bce9ef39469e610aeddb819194ceb7f7edfc0861

-		pl, complete, err = r.readPacketLen()
+		maxLen := int32(jwt.NoLimit)
+		if !connected {
+			maxLen = atomic.LoadInt32(&c.mpay)
+		}
+		pl, complete, err = r.readPacketLen(maxLen)
 		if err != nil || !complete {
+			if err == ErrMaxPayload {
+				c.maxPayloadViolation(pl, maxLen)
+			}
 			break
 		}

The fix passes a maxLen bound to readPacketLen(). When the client is not yet authenticated (!connected), the server enforces the configured maximum payload (c.mpay) and raises ErrMaxPayload for oversized declarations.

Detection Methods for CVE-2026-58210

Indicators of Compromise

Rising resident memory usage of the nats-server process without a corresponding increase in authenticated client sessions
Numerous half-open TCP connections to the MQTT listener port from a small set of source IP addresses
MQTT CONNECT packets that advertise very large remaining-length values but never complete
Server logs showing repeated pre-authentication client disconnects or slow-read conditions

Detection Strategies

Monitor NATS Server memory metrics and alert on sustained growth outside normal baselines
Inspect network telemetry for MQTT connections that establish TCP sessions but never complete the CONNECT handshake
Correlate connection counts per source IP against the MQTT listener to surface volumetric abuse

Monitoring Recommendations

Enable NATS Server operator metrics and scrape varz and connz endpoints for connection and memory statistics
Forward server logs and network flow data to a central analytics platform for anomaly detection
Set alerting thresholds on process RSS, open file descriptors, and MQTT connection rates

How to Mitigate CVE-2026-58210

Immediate Actions Required

Upgrade NATS Server to version 2.14.3 or 2.12.12, whichever matches your release branch
Restrict network access to the MQTT listener using firewall rules or private network segmentation until patching is complete
Reduce the configured max_payload value to constrain pre-authentication buffering on unpatched instances

Patch Information

The vendor released fixes in NATS Server v2.14.3 and NATS Server v2.12.12. The relevant code changes are tracked in commits bce9ef3 and e016e47. Further details are documented in GitHub Security Advisory GHSA-r72h-j7qq-v6qg.

Workarounds

Disable the MQTT listener in nats-server.conf if MQTT is not required in your deployment
Place the NATS Server MQTT listener behind an authenticated reverse proxy or TLS-terminating gateway that enforces client validation
Lower max_payload in the server configuration to restrict the memory each pre-auth connection can request

bash

# Example nats-server.conf snippet to constrain payload size
max_payload: 1MB

# Or disable MQTT entirely if unused
# Remove or comment out the mqtt { ... } block