PT-2026-27616 · Nats.Io · Nats Server

Published 2026-02-24 · Updated 2026-05-21 · CVE-2026-33219

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions NATS-Server versions prior to 2.11.15 NATS-Server versions prior to 2.12.6

Description NATS-Server, a high-performance server for NATS.io, is affected by an issue where a malicious client connecting to the WebSockets port can cause unbounded memory use before authentication. This requires the client to send a corresponding amount of data. This is a milder variant of a previously reported issue that involved a compression bomb. Exploitation of this issue requires significant client bandwidth.

Recommendations Versions prior to 2.11.15 should be updated to version 2.11.15 or later. Versions prior to 2.12.6 should be updated to version 2.12.6 or later. If WebSockets are not required for project deployment, disable them as a workaround.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

CWE-409

Related Identifiers

BIT-NATS-2026-33219

CVE-2026-33219

GHSA-8R68-GVR4-JH7J

GHSA-QRVQ-68C2-7GRW

GO-2026-4831

SUSE-SU-2026:1135-1

Affected Products

Nats Server

References · 165

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33219.json · Exploit
• https://github.com/nats-io/nats-server/security/advisories/GHSA-8r68-gvr4-jh7j · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8r68-gvr4-jh7j · Vendor Advisory
• https://github.com/advisories/GHSA-qrvq-68c2-7grw · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-33219 · Vendor Advisory
• https://advisories.nats.io/CVE/secnote-2026-11.txt · Vendor Advisory
• https://advisories.nats.io/CVE/secnote-2026-02.txt · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33219 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33219 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-GOBINARY-CVE-2026-33219 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33219 · Security Note
• https://osv.dev/vulnerability/GO-2026-4831 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27571 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33219 · Vendor Advisory