Intel

CVE-2026-58250

nats: NULL Pointer Dereference (CVE-2026-58250)

highEPSS 0.7%

Affected

  • bitnami/nats 2.12.0..*

Description

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.12.8 and 2.11.17, an unauthenticated peer with network access to a leafnode listener with compression enabled could crash the server during the pre-authentication leafnode handshake by sending repeated leafnode INFO protocol messages before authentication and account setup completed. This issue is fixed in versions 2.12.8 and 2.11.17.

Source: OSV (Open Source Vulnerabilities)Microsoft Security Update GuideNVD (NIST)cvelistv5CVE.org (MITRE)BSI WID PortalBSI CSAF

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

bitnaminats
2.12.0

Metrics

XIEM Effective CVSS
7.5
Source: nvd-v3
EPSS percentile
53.3 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
KEV status
—
Show all metrics
Severity
high
Priority score
82.42
Exploit maturity
no public PoC known
CVSS v3
7.5
EPSS score
0.7 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-07-14 15:47 UTC
CWE
CWE-476

Weakness classes (CWE)

  • CWE-476Base

    NULL Pointer Dereference

    The product dereferences a pointer that it expects to be valid but is NULL.

    cwe.mitre.org →

References & sources

Linked advisories