CVE-2026-27571: nats-server websockets are vulnerable to pre-auth memory DoS
Impact
The WebSockets handling of NATS messages handles compressed messages via the WebSockets negotiated compression. The implementation bound the memory size of a NATS message but did not independently bound the memory consumption of the memory stream when constructing a NATS message which might then fail validation for size reasons.
An attacker can use a compression bomb to cause excessive memory consumption, often resulting in the operating system terminating the server process.
The use of compression is negotiated before authentication, so this does not require valid NATS credentials to exploit.
The fix was to bounds the decompression to fail once the message was too large, instead of continuing on.
Patches
This was released in nats-server without being highlighted as a security issue. It should have been, this was an oversight. Per the NATS security policy, because this does not require a valid user, it is CVE-worthy.
This was fixed in the v2.11 series with v2.11.12 and in the v2.12 series with v2.12.3.
Workarounds
This only affects deployments which use WebSockets and which expose the network port to untrusted end-points.
References
This was reported to the NATS maintainers by Pavel Kohout of Aisle Research (www.aisle.com).
Other sources
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling of NATS messages handles compressed messages via the WebSockets negotiated compression. Prior to versions 2.11.2 and 2.12.3, the implementation bound the memory size of a NATS message but did not independently bound the memory consumption of the memory stream when constructing a NATS message which might then fail validation for size reasons. An attacker can use a compression bomb to cause excessive memory consumption, often resulting in the operating system terminating the server process. The use of compression is negotiated before authentication, so this does not require valid NATS credentials to exploit. The fix, present in versions 2.11.2 and 2.12.3, was to bounds the decompression to fail once the message was too large, instead of continuing on. The vulnerability only affects deployments which use WebSockets and which expose the network port to untrusted end-points.
— NVD
nats-server websockets are vulnerable to pre-auth memory DoS
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/nats-io/nats-server/v2to a version that resolves this vulnerability.Fixed in 2.12.3 - Upgrade
Upgrade
go/github.com/nats-io/nats-server/v2to a version that resolves this vulnerability.Fixed in 2.11.12 - Upgrade
Upgrade
nats-serverto a version that resolves this vulnerability.Fixed in 2.11.12 - Upgrade
Upgrade
nats-serverto a version that resolves this vulnerability.Fixed in 2.12.3 - Compensating control
For NATS-Server deployments using WebSockets, do not expose the NATS network port (where WebSockets are accepted) to untrusted endpoints.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27571?
CVE-2026-27571 has a medium severity rating due to the potential for memory resource exhaustion in specific scenarios.
How do I fix CVE-2026-27571?
To fix CVE-2026-27571, upgrade to NATS Server version 2.12.3 or later, or 2.11.12 if using an earlier version.
What components are impacted by CVE-2026-27571?
CVE-2026-27571 affects versions of the NATS Server prior to 1.4.1 and certain versions within the 2.x range.
Is CVE-2026-27571 a local or remote vulnerability?
CVE-2026-27571 can be exploited remotely if an attacker successfully sends specially crafted compressed messages.
What operating systems are affected by CVE-2026-27571?
CVE-2026-27571 affects any operating system running the vulnerable versions of the NATS Server.