CVE-2026-58208: 
NixOS vulnerability analysis and mitigation

CVE-2026-58208 is a Denial of Service vulnerability in NATS Server, the high-performance messaging server for NATS.io, caused by improper routing of MQTT-over-WebSocket requests when MQTT is not configured. An unauthenticated attacker with network access to the WebSocket listener can trigger access to uninitialized MQTT state, causing the server process to crash. Affected versions include NATS Server 2.12.0–2.12.11 and 2.14.0-RC.1–2.14.2. The vulnerability was discovered by Vasco Franco of Trail of Bits, published on June 29, 2026, and assigned a CVSS v3.1 base score of 7.5 (High) by NVD, or 6.8 (Moderate) per the GitHub advisory (GitHub Advisory, Feedly).

The root cause is classified as CWE-248 (Uncaught Exception) and CWE-824 (Access of Uninitialized Pointer). In the wsUpgrade function within server/websocket.go, the server failed to check whether MQTT was enabled before routing WebSocket upgrade requests targeting the MQTT-over-WebSocket path (/mqtt). When a request arrived at this path on a server with MQTT disabled, the code proceeded to access uninitialized MQTT state, triggering a Go panic (process crash). The fix adds an explicit guard — if kind == MQTT && opts.MQTT.Port == 0 — that returns an HTTP 404 error before any MQTT state is accessed, rejecting the upgrade request cleanly (GitHub Commit, GitHub Advisory). Deployments with MQTT intentionally configured are not affected, as MQTT state is properly initialized in those cases.

Successful exploitation results in a complete crash of the NATS Server process, causing a full denial of service for all clients and applications depending on the messaging infrastructure. Because the attack requires no authentication and no user interaction, any deployment exposing the WebSocket listener to untrusted networks is at risk of repeated, trivially repeatable crashes. There is no confidentiality or integrity impact; the sole consequence is availability loss, which can be severe in cloud-native, IoT, or edge environments relying on NATS for real-time messaging (GitHub Advisory, Feedly).

1. Reconnaissance: Identify NATS Server instances with WebSocket listeners exposed to the network using tools like Shodan, Censys, or nmap, targeting default WebSocket ports (e.g., 443, 8080, or custom configured ports).
2. Confirm WebSocket availability: Attempt a standard WebSocket upgrade handshake to the server to confirm the listener is active and accessible.
3. Send MQTT-over-WebSocket upgrade request: Craft an HTTP GET request with a WebSocket upgrade header targeting the MQTT-over-WebSocket path (e.g., GET /mqtt HTTP/1.1 with Upgrade: websocket and required WebSocket headers such as Sec-WebSocket-Key).
4. Trigger crash: On a vulnerable server (MQTT disabled, WebSocket enabled), the server routes the request into uninitialized MQTT handling, causing a Go panic and crashing the server process.
5. Repeat for persistent DoS: Since no authentication is required, the attacker can repeatedly send the crafted request each time the server restarts to maintain a denial-of-service condition (GitHub Advisory, GitHub Commit).

• Network: Unexpected HTTP GET requests to the /mqtt WebSocket upgrade path on the NATS Server WebSocket listener port from external or untrusted IP addresses; repeated connection attempts to the WebSocket port shortly after server restarts.
• Logs: NATS Server logs showing Go panic stack traces referencing MQTT or WebSocket upgrade handling (wsUpgrade, MQTT state access); server process crash/restart events logged by the process supervisor (e.g., systemd, Kubernetes).
• Process: Sudden, repeated termination and restart of the nats-server process without administrative action; process supervisor logs indicating unexpected exits with non-zero exit codes.

Upgrade NATS Server to version 2.14.3 or 2.12.12, which contain the fix that rejects MQTT-over-WebSocket upgrade requests with an HTTP 404 when MQTT is not configured (GitHub Release v2.14.3, GitHub Release v2.12.12). If immediate patching is not possible, restrict network access to the WebSocket listener using firewall rules or network policies to allow only trusted clients. Alternatively, disable the WebSocket listener entirely if it is not required for your deployment. Deployments that do not use WebSocket, or that use both WebSocket and MQTT together, are not affected by this vulnerability (GitHub Advisory).

The vulnerability was credited to Vasco Franco of Trail of Bits in the official GitHub Security Advisory, indicating it was responsibly disclosed through a security research engagement (GitHub Advisory). No significant broader media coverage or notable community commentary beyond standard vulnerability tracking aggregators has been observed.