CVE-2026-33219 NATS is vulnerable to pre-auth DoS through WebSockets client service
A malicious client can cause unbounded memory usage in NATS Server via WebSockets before authentication, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33219?
CVE-2026-33219 is a medium-severity denial of service vulnerability in nats-io nats-server, published on 25 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a malicious client which can connect to the WebSockets port can cause unbounded memory use in the nats-server before authentication; this requires sending a corresponding amount of data. This is a milder variant of CVE-2026-27571. That earlier issue was a compression bomb, this vulnerability is not. Attacks against this new issue thus require significant client bandwidth. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, disable websockets if not required for project deployment.
Weakness: CWE-770
Which versions are affected by CVE-2026-33219?
9 open source packages ship an affected version, including github.com/nats-io/nats-server/v2, nats and github.com/nats-io/nats-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/nats-io/nats-server/v2 Go | All versions | 2.11.15, 2.12.6 |
github.com/nats-io/nats-server/v2 Go | All versions | 2.11.15 |
github.com/nats-io/nats-server/v2 Go | All versions | 2.11.15 |
github.com/nats-io/nats-server/v2 Go | From 2.12.0-RC.1 | 2.12.6 |
github.com/nats-io/nats-server/v2 Go | From 2.12.0-RC.1 | 2.12.6 |
nats Bitnami | All versions | 2.11.15, 2.12.6 |
3 more packages
github.com/nats-io/nats-server Go | All versions | None |
github.com/nats-io/nats-server Go | All versions | None |
github.com/nats-io/nats-server Go | All versions | None |
Products include Linuxfoundation Nats-Server.
How do I fix CVE-2026-33219?
Upgrade github.com/nats-io/nats-server/v2 to a fixed version for your release line: 2.11.15 or 2.12.6.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-33219 being exploited?
There is no known exploitation of CVE-2026-33219 in the wild and no public exploit code.
Other vulnerabilities in nats-io nats-server
- CVE-2022-28357 NATS nats-server allows directory traversal via unintended path to a management action
- CVE-2026-58253 NATS Server: Route API Auth Bypass
- CVE-2022-24450 Incorrect Authorization in NATS nats-server
- CVE-2026-33216 NATS has MQTT plaintext password disclosure
- CVE-2026-58207 NATS Server: Remote crash via integer overflow in Connz pagination
Sources
Also known as BIT-nats-2026-33219, CLEANSTART-2026-YJ62834, DEBIAN-CVE-2026-33219, ECHO-06da-c236-18d7, GHSA-8r68-gvr4-jh7j, GO-2026-4831 and 10 more.