CVE-2026-33219: NATS is vulnerable to pre-auth DoS through WebSockets client service
Background
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.
The nats-server offers a WebSockets client service, used in deployments where browsers are the NATS clients.
Problem Description
A malicious client which can connect to the WebSockets port can cause unbounded memory use in the nats-server before authentication; this requires sending a corresponding amount of data.
This is a milder variant of NATS-advisory-ID 2026-02 (aka CVE-2026-27571; GHSA-qrvq-68c2-7grw). That earlier issue was a compression bomb, this vulnerability is not. Attacks against this new issue thus require significant client bandwidth.
Affected Versions
Any version before v2.12.6 or v2.11.15
Workarounds
Disable websockets if not required for project deployment.
Other sources
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a malicious client which can connect to the WebSockets port can cause unbounded memory use in the nats-server before authentication; this requires sending a corresponding amount of data. This is a milder variant of CVE-2026-27571. That earlier issue was a compression bomb, this vulnerability is not. Attacks against this new issue thus require significant client bandwidth. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, disable websockets if not required for project deployment.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/nats-io/nats-server/v2to a version that resolves this vulnerability.Fixed in 2.12.6 - Upgrade
Upgrade
go/github.com/nats-io/nats-server/v2to a version that resolves this vulnerability.Fixed in 2.11.15 - Upgrade
Upgrade
nats-serverto a version that resolves this vulnerability.Fixed in 2.11.15 - Upgrade
Upgrade
nats-serverto a version that resolves this vulnerability.Fixed in 2.12.6 - Configuration
Disable the WebSockets client service if not required for project deployment, to prevent pre-auth DoS via the WebSockets port.
nats-server WebSockets client service websockets (enable/disable) = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33219?
CVE-2026-33219 is classified with a moderate severity level due to its potential impact on the NATS server's WebSockets client service.
How do I fix CVE-2026-33219?
To fix CVE-2026-33219, upgrade your NATS server to version 2.12.6 or 2.11.15 as specified in the remediation guidance.
What are the affected versions for CVE-2026-33219?
CVE-2026-33219 affects NATS server versions from 2.12.0-RC.1 to 2.12.6 and all versions below 2.11.15.
What are the components impacted by CVE-2026-33219?
CVE-2026-33219 impacts the WebSockets client service of the NATS server, particularly in deployments where browsers are the clients.
Is there a workaround for CVE-2026-33219?
There are currently no documented workarounds for CVE-2026-33219; updating to a patched version is the recommended solution.