This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-58214 →
DEBIAN-CVE-2026-58214
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an authenticated MQTT c...
Original description
The description as published by the source.
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an authenticated MQTT client could subscribe to the internal $MQTT.deliver.pubrel subject family, bypassing configured subscribe permissions and exposing MQTT QoS2 protocol metadata for sessions in the account. This issue is fixed in versions 2.14.3 and 2.12.12.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
nats-server
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
nats-server
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
nats-server
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.3-1"}]}]
References
- advisory security-tracker.debian.org