CVE-2026-58250: NATS Server DoS Vulnerability

CVE-2026-58250 Overview

CVE-2026-58250 is a null pointer dereference vulnerability in NATS Server, the messaging system for the NATS.io cloud and edge native platform. An unauthenticated remote attacker with network access to a leafnode listener with compression enabled can crash the server during the pre-authentication leafnode handshake. The attack works by sending repeated leafnode INFO protocol messages before authentication and account setup complete. This is a denial-of-service issue tracked as CWE-476. The issue is fixed in NATS Server versions 2.12.8 and 2.11.17.

Critical Impact

An unauthenticated network attacker can crash NATS Server instances exposing a compression-enabled leafnode listener, causing service outage for messaging workloads.

Affected Products

• NATS Server versions prior to 2.11.17 (2.11.x branch)
• NATS Server versions prior to 2.12.8 (2.12.x branch)
• Deployments exposing leafnode listeners with compression enabled

Discovery Timeline

• 2026-07-08 - CVE-2026-58250 published to NVD
• 2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-58250

Vulnerability Analysis

The vulnerability is a null pointer dereference in the leafnode handshake handler in server/leafnode.go. NATS leafnodes are lightweight satellite servers that bridge messaging between edge and core clusters. Before authentication completes, the server temporarily processes INFO protocol frames to negotiate compression and capabilities. During this pre-authentication window, sending repeated INFO messages can trigger a code path that dereferences the connection's account field (c.acc) before it has been populated by the authentication handler. The result is a nil dereference that panics the Go runtime and terminates the server process, disrupting all NATS clients and leaf connections routed through that instance.

Root Cause

The root cause is missing state validation in the leafnode INFO protocol handler. When the incoming INFO message contained a RemoteAccount field, the server attempted to store the mapping via s.leafRemoteAccounts.Store(c.acc.Name, info.RemoteAccount) without first verifying that c.acc was non-nil. Because the account pointer is only assigned once authentication and account resolution finish, a well-timed second INFO frame reaches this branch while c.acc is still nil, triggering the panic.

Attack Vector

Exploitation requires only network reachability to a leafnode listener with compression enabled. No credentials, user interaction, or prior access are needed. An attacker opens a TCP session to the leafnode port and sends crafted INFO protocol messages including a RemoteAccount value before completing the authentication exchange. Each successful attempt crashes the target process.

// Patch applied to server/leafnode.go
// Check if we have the remote account information and if so make sure it's stored.
if info.RemoteAccount != _EMPTY_ {
    if c.acc == nil {
        c.mu.Unlock()
        c.sendErr("Authorization Violation")
        c.closeConnection(ProtocolViolation)
        return
    }
    s.leafRemoteAccounts.Store(c.acc.Name, info.RemoteAccount)
}
c.mu.Unlock()

Source: NATS Server commit 8dcb26e. The patch guards the store operation with a c.acc == nil check and terminates the connection with an authorization violation instead of dereferencing a nil pointer.

Detection Methods for CVE-2026-58250

Indicators of Compromise

• Unexpected NATS Server process crashes or restarts with Go runtime panic traces referencing leafnode.go.
• Repeated inbound TCP connections to the configured leafnode port from unfamiliar source addresses that terminate mid-handshake.
• Multiple leafnode INFO protocol frames within a single pre-authentication session in server debug logs.

Detection Strategies

• Enable verbose or debug logging on NATS Server and alert on stack traces containing runtime error: invalid memory address or nil pointer dereference originating from leafnode handling.
• Monitor process supervisors (systemd, Kubernetes) for repeated restart events on NATS pods or services.
• Correlate network flow logs for short-lived connections to leafnode ports followed immediately by service downtime.

Monitoring Recommendations

• Track NATS Server uptime and restart counts as SLO metrics; sudden restart bursts warrant investigation.
• Alert on new source IPs establishing leafnode sessions from outside your leaf topology allowlist.
• Capture packet samples on leafnode listeners to identify malformed or duplicate INFO frames during handshake.

How to Mitigate CVE-2026-58250

Immediate Actions Required

• Upgrade NATS Server to 2.11.17 or 2.12.8 or later on all nodes running leafnode listeners.
• Restrict network exposure of leafnode ports to known peer IPs using firewall rules or security groups.
• If patching is delayed, disable compression on the leafnode listener to remove the vulnerable code path.

Patch Information

Fixed releases are available at NATS Server v2.11.17 and NATS Server v2.12.8. The upstream fix is documented in the GitHub Security Advisory GHSA-3g5q-cfh2-cq67 and applied in commit 8dcb26e and commit fc5fe39.

Workarounds

• Disable compression on the leafnode block in nats-server.conf until the upgrade is applied.
• Place leafnode listeners behind a TLS-terminating proxy that enforces client certificate authentication.
• Restrict leafnode listener bindings to internal interfaces only and block public access at the perimeter.

# Example leafnode configuration with compression disabled as a temporary workaround
leafnodes {
  listen: "0.0.0.0:7422"
  # compression removed / set to off until upgrade to 2.11.17 or 2.12.8
  compression: "off"
  tls {
    cert_file: "/etc/nats/server-cert.pem"
    key_file:  "/etc/nats/server-key.pem"
    verify:    true
  }
}