Junglewise Threat Intelligence

CVE-2026-33219: NATS-Server denial of service in WebSockets component

CVE-2026-33219 · Severity: medium · CVSS 5.3 · Published 2026-03-25

Technologies: github.com/nats-io/nats-server/v2 (Go), Nats-Io NATS Server, github.com/nats-io/nats-server (Go). Vendors: Go.

Executive brief

NATS-Server is a high-performance messaging system used for cloud and edge computing. A vulnerability in its WebSocket handling allows an unauthenticated attacker to cause the server to consume excessive amounts of memory by sending large volumes of data. This can lead to a denial-of-service (DoS) condition where the server becomes unresponsive or is terminated by the operating system, potentially disrupting communications across the infrastructure.

Technical details

A vulnerability exists in the nats-server WebSockets implementation where memory allocation for incoming messages is not properly bounded before authentication occurs. An attacker can connect to the WebSockets port and send a large volume of data to trigger unbounded memory use, leading to a Denial of Service (DoS). Unlike the related CVE-2026-27571 which utilized a compression bomb, this flaw requires the attacker to provide the actual volume of data corresponding to the memory consumed, making it dependent on the attacker's available bandwidth. The issue is fixed in versions 2.11.15 and 2.12.6. As a workaround, administrators can disable WebSockets if they are not required for the deployment.

Affected products

  • nats-io nats-server < 2.11.15, >= 2.12.0-RC.1 < 2.12.6

Timeline

  • 2026-03-24: advisory: Vendor advisory NATS-2026-11 published
  • 2026-03-25: disclosed: CVE-2026-33219 published to NVD

References

Related threats