# CVE-2026-33219: NATS-Server denial of service in WebSockets component

Source: https://junglewise.ai/threats/cve-2026-33219-nats-server-denial-of-service-in-websockets-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-25. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-33219 · Severity: medium · CVSS 5.3 · Published 2026-03-25

NATS-Server is a high-performance messaging system used for cloud and edge computing. A vulnerability in its WebSocket handling allows an unauthenticated attacker to cause the server to consume excessive amounts of memory by sending large volumes of data. This can lead to a denial-of-service (DoS) condition where the server becomes unresponsive or is terminated by the operating system, potentially disrupting communications across the infrastructure.

Technologies: [github.com/nats-io/nats-server (Go)](https://junglewise.ai/threats/technologies/github-com-nats-io-nats-server), [github.com/nats-io/nats-server/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-nats-io-nats-server-v2). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-33219 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33219 being exploited in the wild.

**How severe is CVE-2026-33219?** Medium severity, with a CVSS score of 5.3, published 25 March 2026.

**Which products and versions are affected?** github.com/nats-io/nats-server (Go) SEMVER:introduced=0; github.com/nats-io/nats-server/v2 (Go) SEMVER:introduced=0,fixed=2.11.15, SEMVER:introduced=0,fixed=2.11.15,introduced=2.12.0-RC.1,fixed=2.12.6.

**Is there a fix for CVE-2026-33219?** Yes. github.com/nats-io/nats-server/v2 (Go): upgrade to 2.11.15, 2.12.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33219 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-33219?** Check whether you run github.com/nats-io/nats-server (Go) or github.com/nats-io/nats-server/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/nats-io/nats-server/v2 (Go): upgrade to 2.11.15, 2.12.6 or later

  ```sh
  go get github.com/nats-io/nats-server/v2@v2.12.6
  ```


## Technical details

A vulnerability exists in the nats-server WebSockets implementation where memory allocation for incoming messages is not properly bounded before authentication occurs. An attacker can connect to the WebSockets port and send a large volume of data to trigger unbounded memory use, leading to a Denial of Service (DoS). Unlike the related CVE-2026-27571 which utilized a compression bomb, this flaw requires the attacker to provide the actual volume of data corresponding to the memory consumed, making it dependent on the attacker's available bandwidth. The issue is fixed in versions 2.11.15 and 2.12.6. As a workaround, administrators can disable WebSockets if they are not required for the deployment.

## Affected products

- nats-io nats-server < 2.11.15, >= 2.12.0-RC.1 < 2.12.6

## Identifiers

- CVE-2026-33219
- GHSA-8r68-gvr4-jh7j
- GO-2026-4831

## Timeline

- 2026-03-24: advisory: Vendor advisory NATS-2026-11 published
- 2026-03-25: disclosed: CVE-2026-33219 published to NVD

## References

- [https://advisories.nats.io/CVE/secnote-2026-02.txt](https://advisories.nats.io/CVE/secnote-2026-02.txt)
- [https://advisories.nats.io/CVE/secnote-2026-11.txt](https://advisories.nats.io/CVE/secnote-2026-11.txt)
- [https://github.com/nats-io/nats-server/security/advisories/GHSA-8r68-gvr4-jh7j](https://github.com/nats-io/nats-server/security/advisories/GHSA-8r68-gvr4-jh7j)
- [https://access.redhat.com/errata/RHSA-2026:21769](https://access.redhat.com/errata/RHSA-2026:21769)
- [https://access.redhat.com/errata/RHSA-2026:22347](https://access.redhat.com/errata/RHSA-2026:22347)
- [https://access.redhat.com/errata/RHSA-2026:23345](https://access.redhat.com/errata/RHSA-2026:23345)

## Related threats

- [GO-2026-4833 - NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server](https://junglewise.ai/threats/cve-2026-33215-nats-is-vulnerable-to-mqtt-hijacking-via-client-id)
- [NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing](https://junglewise.ai/threats/cve-2026-33223-nats-server-incomplete-stripping-of-nats-request-info-header)
- [GO-2026-4830 - NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers in github.com/nats-io/nats-server](https://junglewise.ai/threats/cve-2026-33246-nats-leafnode-connections-allow-spoofing-of-nats-request-info)
- [GO-2026-4832 - NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server](https://junglewise.ai/threats/cve-2026-33222-nats-jetstream-has-an-authorization-bypass-through-its-management)
- [NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching](https://junglewise.ai/threats/cve-2026-33248-nats-has-mtls-verify-and-map-authentication-bypass-via-incorrect)