NATS-Server WebSockets Memory Consumption Vulnerability in NATS.io
CVE-2026-27571
What is CVE-2026-27571?
NATS-Server, a high-performance messaging server, faces a memory consumption vulnerability when handling WebSockets compressed messages. Attackers can leverage a compression bomb to exhaust server memory resources, potentially causing the host operating system to terminate the server process. This vulnerability arises from inadequate bounding of memory consumption during message construction, which can lead to a failure in message size validation. Critically, the method for negotiating compression occurs before authentication, enabling exploitation without needing valid NATS credentials. Deployments using WebSockets and exposing network ports to untrusted endpoints are particularly at risk. Users are encouraged to update to versions 2.11.2 or 2.12.3, which implement proper decompression bounds to mitigate this issue.
Affected Version(s)
nats-server < 2.11.12 < 2.11.12
nats-server >= 2.12.0-RC.1, < 2.12.3 < 2.12.0-RC.1, 2.12.3