CVE-2026-27889: NATS Server Remote Denial of Service via WebSocket Frame Length Overflow
Summary
CVE-2026-27889: NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead. Affects github.com/nats-io/nats-server/v2 across 2 version ranges.
>= 2.2.0, < 2.11.14
>= 2.12.0, < 2.12.5
Fixed in 2.11.14 or 2.12.5, depending on the release line you run. How to fix ↓
Also tracked for
- nats · Bitnami
- github.com/nats-io/nats-server · Go
The same CVE-2026-27889 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NATS.io is a high-performance open-source pub-sub distributed communication technology designed for cloud, on-premise, IoT, and edge computing. It facilitates efficient messaging between clients and servers, making it suitable for various applications. However, a vulnerability exists in its WebSocket implementation that can be exploited by malicious clients.
Vulnerability Detail
The vulnerability arises from a missing sanity check on WebSocket frames in the NATS server. An attacker can send a specially crafted WebSocket frame that triggers a server panic before authentication occurs. This results in a denial of service, as the entire NATS server process crashes, disconnecting all clients and disrupting services. The issue is rooted in the improper handling of a 64-bit extended payload length, which can lead to negative integer values and subsequent runtime panics.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.2.0, < 2.11.142.11.14go get github.com/nats-io/nats-server/v2@v2.11.14 -
>= 2.12.0, < 2.12.52.12.5go get github.com/nats-io/nats-server/v2@v2.12.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, consider restricting access to the WebSocket port to trusted endpoints only. This can mitigate the risk of exploitation by untrusted clients.
Conclusion
CVE-2026-27889 is a critical vulnerability in the NATS server that can lead to a denial of service through malicious WebSocket frames. It is essential for users to upgrade to the patched versions to protect their deployments and ensure service continuity.
See every vulnerability recorded for github.com/nats-io/nats-server/v2 →
FAQ
CVE-2026-27889 is a vulnerability in the NATS server that allows unauthenticated remote attackers to crash the server by sending a malicious WebSocket frame.
Any deployment of the NATS server that has WebSocket listeners enabled and exposes the WebSocket port to untrusted networks is at risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The CVSS score for this vulnerability is 7.5, indicating a high severity level, as it can lead to a complete denial of service.
As a temporary measure, restrict access to the WebSocket port to trusted clients only to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/nats-io/nats-server/v2.
