EUVD-2026-42391Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated request over an enabled WebSocket listener triggers a crash with no auth or interaction, so AV:N/AC:L/PR:N/UI:N; impact is availability-only (A:H), C:N/I:N.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
9DescriptionNVD
[Unknown description]
AnalysisAI
Remote denial-of-service in NATS Server (nats-server) affects deployments with the WebSocket listener enabled but MQTT disabled; per the GHSA-p957-7v2w-g93g advisory and the fixing commit, an unauthenticated attacker can send an MQTT-over-WebSocket upgrade request to the WebSocket endpoint while MQTT is turned off, triggering an uncaught exception (CWE-248) that crashes the server (CVSS 7.5, availability-only impact). This is a Linux Foundation CNCF messaging component fixed in nats-server 2.12.12 and 2.14.3. No public exploit identified at time of analysis; not listed in CISA KEV, and EPSS is low at 0.53% (41st percentile), consistent with the SSVC assessment of exploitation 'none' and only partial technical impact.
Technical ContextAI
NATS Server is a high-performance, open-source messaging system (a CNCF project maintained under the Linux Foundation / nats-io) supporting core NATS, JetStream, MQTT, and WebSocket transports. The flaw is in the WebSocket upgrade path (server/websocket.go, wsUpgrade). NATS multiplexes protocol 'kinds' (CLIENT, MQTT, etc.) over WebSocket paths, and the code previously accepted an MQTT-kind upgrade request even when the MQTT subsystem was not configured (opts.MQTT.Port == 0). Downstream handling of an MQTT connection that has no initialized MQTT server state leads to an uncaught exception/panic, the root-cause class described by CWE-248 (Uncaught Exception). The fix rejects such upgrades early with an HTTP 404 ('mqtt websocket endpoint not enabled'), as shown by the added guard and the new TestWSUpgradeMQTTOnlyWhenEnabled test. The affected CPE is cpe:2.3:a:linuxfoundation:nats-server across the vulnerable version ranges.
RemediationAI
Vendor-released patch: upgrade to nats-server 2.12.12 (for the 2.12.x line and earlier) or 2.14.3 (for the 2.14.x / 2.14.0-RC line), per GHSA-p957-7v2w-g93g and the release notes at https://github.com/nats-io/nats-server/releases/tag/v2.12.12 and https://github.com/nats-io/nats-server/releases/tag/v2.14.3; the fix is commit 73b3dd9a5ea0fa7bf08b702338676355b29b5fb4, which rejects MQTT-over-WebSocket upgrades when MQTT is not enabled. If immediate patching is not possible, the concrete compensating control is to restrict or disable the WebSocket listener, or place the WebSocket endpoint behind a reverse proxy / network ACL that blocks untrusted access to the MQTT WebSocket path - trade-off: this breaks legitimate browser/WebSocket clients that rely on that listener. Alternatively, if MQTT-over-WebSocket is actually needed, enabling MQTT (setting a valid MQTT port) removes the crash path but expands the protocol surface, so only do so intentionally. Do not expose the WebSocket port directly to the internet in the interim.
More in Nats Server
View allNATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings ar
The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are han
This affects all versions of package github.com/nats-io/nats-server/server. Rated high severity (CVSS 7.5), this vulnera
NATS nats-server before 2.7.2 has Incorrect Access Control. Rated high severity (CVSS 8.8), this vulnerability is remote
Authentication bypass in NATS Server (nats-io/nats-server) lets an unauthenticated attacker on an adjacent network conne
Denial of service in NATS Server (nats-server) MQTT handler allows a remote, unauthenticated client to exhaust server me
Remote denial of service in the NATS Server (nats-io/nats-server) leafnode subsystem allows unauthenticated attackers to
An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted reques
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise,
The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code). Rated high s
Protocol injection in NATS Server MQTT support allows an authenticated MQTT client to smuggle control characters (tab, n
NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStre
Same weakness CWE-248 – Uncaught Exception
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today