NATS-Server WebSockets Memory Consumption Vulnerability in NATS.io
CVE-2026-27571
What is CVE-2026-27571?
NATS-Server, a high-performance messaging server, faces a memory consumption vulnerability when handling WebSockets compressed messages. Attackers can leverage a compression bomb to exhaust server memory resources, potentially causing the host operating system to terminate the server process. This vulnerability arises from inadequate bounding of memory consumption during message construction, which can lead to a failure in message size validation. Critically, the method for negotiating compression occurs before authentication, enabling exploitation without needing valid NATS credentials. Deployments using WebSockets and exposing network ports to untrusted endpoints are particularly at risk. Users are encouraged to update to versions 2.11.2 or 2.12.3, which implement proper decompression bounds to mitigate this issue.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
nats-server < 2.11.12 < 2.11.12
nats-server >= 2.12.0-RC.1, < 2.12.3 < 2.12.0-RC.1, 2.12.3