NATS Server CVE-2026-58208

Requires the NATS WebSocket listener to be enabled AND the MQTT subsystem to be disabled (opts.MQTT.Port == 0). The attacker connects to the WebSocket endpoint and issues an MQTT-over-WebSocket upgrade request against the MQTT WebSocket path (mqttWSPath, e.g. '/mqtt'); the server accepts the MQTT-kind upgrade with no MQTT server initialized, causing an uncaught exception. Limiting factors: WebSocket is not enabled by default in NATS, so vulnerable instances are only those explicitly configured with WebSocket on but MQTT off; if MQTT is enabled, the vulnerable code path is not reached. Exploitation is remote and unauthenticated (PR:N) once the WebSocket port is reachable, and impact is limited to availability (server crash), not data disclosure or code execution.

The signals converge on moderate, not urgent, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5) reflects a remote, unauthenticated, availability-only impact - a crash, not code execution or data theft. This is reinforced by CISA SSVC (Exploitation: none, Automatable: no, Technical Impact: partial) and a low EPSS of 0.53% (41st percentile), with no KEV listing and no public exploit identified. Two data conflicts should be noted explicitly: first, the 'Information Disclosure' tag contradicts the CVSS vector, which sets C:N/I:N and only A:H - the actual impact per the code fix is denial of service, so the Information Disclosure tag appears to be a mislabel and should be verified with the vendor advisory. Second, the PR:N/AC:L rating assumes the WebSocket listener is reachable, but WebSocket is not enabled by default in NATS, so real-world exposure is narrower than the raw 7.5 implies. Net: patch on a normal cycle; treat as elevated only where WebSocket is internet-exposed and MQTT is disabled.

An attacker who can reach a NATS Server's WebSocket port on a deployment where MQTT is disabled opens a WebSocket handshake to the MQTT path and sends an MQTT-kind upgrade request. Because the server accepts the MQTT upgrade despite MQTT being unconfigured, it hits an uncaught exception and the nats-server process crashes, disrupting all messaging clients. No authentication or user interaction is required (AV:N/AC:L/PR:N/UI:N); no public exploit code has been identified, but the fixing commit and its test clearly illustrate the trigger.