nats-io/nats-server · Security
NATS is vulnerable to pre-auth DoS through WebSockets client service
- GHSA ID
- GHSA-8r68-gvr4-jh7j
- CVE ID
- CVE-2026-33219
- Severity
- medium
- Published
- Updated
- CVSS
- 5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- CVSS v3
- 5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Description
Background
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.
The nats-server offers a WebSockets client service, used in deployments where browsers are the NATS clients.
Problem Description
A malicious client which can connect to the WebSockets port can cause unbounded memory use in the nats-server before authentication; this requires sending a corresponding amount of data.
This is a milder variant of NATS-advisory-ID 2026-02 (aka CVE-2026-27571; GHSA-qrvq-68c2-7grw). That earlier issue was a compression bomb, this vulnerability is not. Attacks against this new issue thus require significant client bandwidth.
Affected Versions
Any version before v2.12.6 or v2.11.15
Workarounds
Disable websockets if not required for project deployment.
CWEs
- CWE-770 · Allocation of Resources Without Limits or Throttling
References
- https://github.com/nats-io/nats-server/security/advisories/GHSA-8r68-gvr4-jh7j ↗
- https://advisories.nats.io/CVE/secnote-2026-02.txt ↗
- https://advisories.nats.io/CVE/secnote-2026-11.txt ↗
- https://github.com/advisories/GHSA-qrvq-68c2-7grw ↗
- https://nvd.nist.gov/vuln/detail/CVE-2026-33219 ↗
- https://github.com/advisories/GHSA-8r68-gvr4-jh7j ↗