CVE-2026-27889 NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead
Unauthenticated remote attackers can crash the NATS server via a WebSocket frame length overflow, requiring WebSockets to be enabled and exposed.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27889?
CVE-2026-27889 is a high-severity vulnerability in nats-io nats-server, published on 25 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.2.0 and prior to versions 2.11.14 and 2.12.5, a missing sanity check on a WebSockets frame could trigger a server panic in the nats-server. This happens before authentication, and so is exposed to anyone who can connect to the websockets port. Versions 2.11.14 and 2.12.5 contains a fix. A workaround is available. The vulnerability only affects deployments which use WebSockets and which expose the network port to untrusted end-points. If one is able to do so, a defense in depth of restricting either of these will mitigate the attack.
Which versions are affected by CVE-2026-27889?
9 open source packages ship an affected version, including github.com/nats-io/nats-server/v2, nats and github.com/nats-io/nats-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/nats-io/nats-server/v2 Go | From 2.12.0 | 2.12.5 |
github.com/nats-io/nats-server/v2 Go | From 2.12.0 | 2.12.5 |
github.com/nats-io/nats-server/v2 Go | From 2.2.0 | 2.11.14, 2.12.5 |
github.com/nats-io/nats-server/v2 Go | From 2.2.0 | 2.11.14 |
github.com/nats-io/nats-server/v2 Go | From 2.2.0 | 2.11.14 |
nats Bitnami | From 2.2.0 | 2.11.14, 2.12.5 |
3 more packages
github.com/nats-io/nats-server Go | All versions | None |
github.com/nats-io/nats-server Go | All versions | None |
github.com/nats-io/nats-server Go | All versions | None |
Products include Linuxfoundation Nats-Server.
How do I fix CVE-2026-27889?
Upgrade github.com/nats-io/nats-server/v2 to a fixed version for your release line: 2.12.5 or 2.11.14.
Is CVE-2026-27889 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27889 exists.
Other vulnerabilities in nats-io nats-server
- CVE-2022-28357 NATS nats-server allows directory traversal via unintended path to a management action
- CVE-2026-58253 NATS Server: Route API Auth Bypass
- CVE-2022-24450 Incorrect Authorization in NATS nats-server
- CVE-2026-33216 NATS has MQTT plaintext password disclosure
- CVE-2026-58207 NATS Server: Remote crash via integer overflow in Connz pagination
Sources
Also known as BIT-nats-2026-27889, DEBIAN-CVE-2026-27889, ECHO-40be-1155-f2d0, GHSA-pq2q-rcw4-3hr6, GO-2026-4841, JLSEC-2026-1121 and 9 more.