CVE-2026-27571

HIGH EPSS 37.7%
Published Feb 24, 20264mo ago · Modified Feb 26, 20264mo ago
7.5 CVSS 3.1
High
Find Similar
Published Feb 24, 2026 4mo ago
Last Modified Feb 26, 2026 4mo ago

Description

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling of NATS messages handles compressed messages via the WebSockets negotiated compression. Prior to versions 2.11.2 and 2.12.3, the implementation bound the memory size of a NATS message but did not independently bound the memory consumption of the memory stream when constructing a NATS message which might then fail validation for size reasons. An attacker can use a compression bomb to cause excessive memory consumption, often resulting in the operating system terminating the server process. The use of compression is negotiated before authentication, so this does not require valid NATS credentials to exploit. The fix, present in versions 2.11.2 and 2.12.3, was to bounds the decompression to fail once the message was too large, instead of continuing on. The vulnerability only affects deployments which use WebSockets and which expose the network port to untrusted end-points.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
37.7% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-409
CWE-770

Affected Products 2

VendorProductVersionRange
linuxfoundationnats-server* <2.11.12
linuxfoundationnats-server*≥2.12.0  –  <2.12.3

References 4

  • github.com https://github.com/nats-io/nats-server/commit/f77fb7c4535e6727cc1a2899cd8e6bbdd8ba2017
    Patch
  • github.com https://github.com/nats-io/nats-server/releases/tag/v2.11.12
    ProductRelease Notes
  • github.com https://github.com/nats-io/nats-server/releases/tag/v2.12.3
    ProductRelease Notes
  • github.com https://github.com/nats-io/nats-server/security/advisories/GHSA-qrvq-68c2-7grw
    Vendor Advisory

Remediation

  • github.com https://github.com/nats-io/nats-server/commit/f77fb7c4535e6727cc1a2899cd8e6bbdd8ba2017
    Patch