WebSocket to MQTT Routing Flaw in NATS Server

Executive Summary

This vulnerability exists in the NATS Server, a high-performance messaging server. Before versions 2.14.3 and 2.12.12, the WebSocket listener could mistakenly route requests intended for MQTT-over-WebSocket to the MQTT handler even if MQTT was not configured. This allowed an unauthenticated client with access to the WebSocket listener to reach an uninitialized MQTT state, which could cause the server process to crash.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is a potential denial of service (DoS) condition. An unauthenticated attacker with access to the WebSocket listener can cause the NATS Server to crash by triggering the uninitialized MQTT state, leading to service disruption.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your NATS Server to version 2.14.3 or 2.12.12 or later, where the issue is fixed.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in NATS Server (CVE-2026-58208) causes a denial of service by crashing the server when an unauthenticated client accesses uninitialized MQTT state via a WebSocket listener. This impacts server availability but does not directly affect confidentiality or integrity of data.

Since the issue leads to server crashes and potential service disruption, it could indirectly affect compliance with standards and regulations that require high availability and reliability of systems, such as HIPAA's requirements for system availability or GDPR's requirements for data processing continuity.

However, there is no indication from the provided information that this vulnerability leads to unauthorized data access or data breaches, so direct compliance violations related to data confidentiality or privacy are not evident.

To maintain compliance, affected deployments should upgrade to the fixed versions (2.14.3 or 2.12.12) to prevent service disruption.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability occurs when a WebSocket listener routes MQTT-over-WebSocket requests to MQTT handling even when MQTT is not configured, causing the server to crash. Detection involves identifying if your NATS Server version is vulnerable (versions prior to 2.14.3 and 2.12.12) and if your deployment enables WebSocket without MQTT.

To detect attempts to exploit this vulnerability on your network or system, you can monitor WebSocket upgrade requests targeting the MQTT-over-WebSocket path (typically "/mqtt") on your NATS Server. Unexpected or unauthorized WebSocket upgrade requests to the MQTT path when MQTT is disabled may indicate exploitation attempts.

While no specific detection commands are provided in the resources, you can use network monitoring tools like tcpdump or Wireshark to filter WebSocket upgrade requests to the "/mqtt" path. For example, using tcpdump to capture WebSocket upgrade HTTP requests containing "/mqtt" in the HTTP GET request URI on the NATS Server port (default 4222):

• tcpdump -i <interface> -A -s 0 'tcp port 4222 and (((tcp[((tcp[12] & 0xf0) >> 2):4]) = 0x47455420))' | grep "/mqtt"

Additionally, reviewing NATS Server logs for crashes or panics related to WebSocket upgrade requests can help detect exploitation attempts.

The recommended mitigation is to upgrade to NATS Server versions 2.14.3 or 2.12.12 or later, as no workaround exists for WebSocket-only deployments without MQTT.

Useful 0 Not Useful 0