NATS Server CVE-2026-58250

Exploitation requires that the target NATS Server has a leafnode listener enabled and reachable by the attacker (the LeafNode port must be configured and network-accessible); the vendor test also exercises it with leafnode compression negotiation (CompressionS2Auto) so an initial INFO is exchanged. The concrete trigger is sending a second INFO protocol message (e.g. containing remote_account or connect_info) after the first INFO but before any CONNECT, while the connection's account is still unbound. No authentication is needed (CVSS PR:N, and the crash occurs pre-CONNECT), no user interaction is required, and no non-default option beyond having leafnodes turned on is necessary. The primary limiting factor is exposure of the leafnode port: servers with no leafnode listener, or with the listener firewalled to trusted peers only, are not reachable for this attack.

This is a genuine, easily-triggered availability risk for any deployment exposing a leafnode listener, but its blast radius is bounded to denial of service - the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H correctly shows network reachability, low complexity, no privileges, no user interaction, and no confidentiality or integrity impact. No EPSS score, KEV status, or SSVC decision data was provided in the input, so exploitation probability and automatability cannot be quantified from available signals; absence of these is not evidence of low interest. The practical severity hinges on exposure: leafnode ports are frequently reachable across trust boundaries (that is their purpose), and the crash is a single unauthenticated packet with no special tooling, so where leafnodes are internet- or partner-facing this should be treated as a real patch priority rather than a theoretical high-CVSS issue. Where the leafnode listener is disabled or tightly network-restricted, real-world risk is correspondingly low.

An attacker who can reach a NATS server's leafnode TCP port opens a connection, reads the server's initial INFO, replies with 'INFO {}' to pass compression negotiation, then immediately sends a second frame such as 'INFO {"remote_account":"attacker"}' before ever sending CONNECT. The server dereferences the still-nil account pointer and panics, crashing the process and dropping all messaging traffic; because the payload is trivial and requires no credentials, it can be scripted and repeated to keep the service down after every restart.