CVE-2026-33219: NATS-Server denial of service in WebSockets component

CVE-2026-33219 · Severity: medium · CVSS 5.3 · Published 2026-03-25

NATS-Server is a high-performance messaging system used for cloud and edge computing. A vulnerability in its WebSocket handling allows an unauthenticated attacker to cause the server to consume excessive amounts of memory by sending large volumes of data. This can lead to a denial-of-service (DoS) condition where the server becomes unresponsive or is terminated by the operating system, potentially disrupting communications across the infrastructure.

Technologies: github.com/nats-io/nats-server (Go), github.com/nats-io/nats-server/v2 (Go). Vendors: Go.

Quick answers

Is CVE-2026-33219 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33219 being exploited in the wild.
How severe is CVE-2026-33219?
Medium severity, with a CVSS score of 5.3, published 25 March 2026.
Which products and versions are affected?
github.com/nats-io/nats-server (Go) SEMVER:introduced=0; github.com/nats-io/nats-server/v2 (Go) SEMVER:introduced=0,fixed=2.11.15, SEMVER:introduced=0,fixed=2.11.15,introduced=2.12.0-RC.1,fixed=2.12.6.
Is there a fix for CVE-2026-33219?
Yes. github.com/nats-io/nats-server/v2 (Go): upgrade to 2.11.15, 2.12.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33219 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-33219?
Check whether you run github.com/nats-io/nats-server (Go) or github.com/nats-io/nats-server/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/nats-io/nats-server/v2 (Go): upgrade to 2.11.15, 2.12.6 or later
    go get github.com/nats-io/nats-server/v2@v2.12.6

Technical details

A vulnerability exists in the nats-server WebSockets implementation where memory allocation for incoming messages is not properly bounded before authentication occurs. An attacker can connect to the WebSockets port and send a large volume of data to trigger unbounded memory use, leading to a Denial of Service (DoS). Unlike the related CVE-2026-27571 which utilized a compression bomb, this flaw requires the attacker to provide the actual volume of data corresponding to the memory consumed, making it dependent on the attacker's available bandwidth. The issue is fixed in versions 2.11.15 and 2.12.6. As a workaround, administrators can disable WebSockets if they are not required for the deployment.

Affected products

  • nats-io nats-server < 2.11.15, >= 2.12.0-RC.1 < 2.12.6

Identifiers

  • CVE-2026-33219
  • GHSA-8r68-gvr4-jh7j
  • GO-2026-4831

Timeline

  • 2026-03-24: advisory: Vendor advisory NATS-2026-11 published
  • 2026-03-25: disclosed: CVE-2026-33219 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.