CVE-2026-27571
📋 TL;DR
This vulnerability in NATS-Server allows attackers to cause denial of service via compression bombs in WebSocket messages. It affects deployments using WebSockets exposed to untrusted endpoints, and exploitation doesn't require authentication since compression is negotiated before credentials are checked.
💻 Affected Systems
- NATS-Server
📦 What is this software?
Nats Server by Linuxfoundation
Nats Server by Linuxfoundation
⚠️ Risk & Real-World Impact
Worst Case
Complete server process termination due to excessive memory consumption, causing service disruption for all connected clients.
Likely Case
Server crashes or becomes unresponsive under targeted attack, requiring manual restart and causing temporary service outage.
If Mitigated
Minimal impact if proper network segmentation and access controls prevent untrusted access to WebSocket endpoints.
🎯 Exploit Status
Attack requires sending specially crafted compressed WebSocket messages to vulnerable endpoints
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.11.2 or 2.12.3
Vendor Advisory: https://github.com/nats-io/nats-server/security/advisories/GHSA-qrvq-68c2-7grw
Restart Required: Yes
Instructions:
1. Stop NATS-Server service. 2. Update to version 2.11.2 or 2.12.3 using package manager or manual download. 3. Restart NATS-Server service.
🔧 Temporary Workarounds
Disable WebSocket compression
allConfigure NATS-Server to disable WebSocket compression to prevent exploitation
Add 'websocket: { compression: false }' to NATS configuration
Restrict WebSocket access
linuxUse firewall rules to limit WebSocket endpoint access to trusted sources only
iptables -A INPUT -p tcp --dport <websocket_port> -s <trusted_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport <websocket_port> -j DROP
🧯 If You Can't Patch
- Implement network segmentation to isolate WebSocket endpoints from untrusted networks
- Deploy rate limiting or Web Application Firewall (WAF) to detect and block compression bomb patterns
🔍 How to Verify
Check if Vulnerable:
Check NATS-Server version and WebSocket configuration. If version <2.11.2 or <2.12.3 and WebSockets are enabled with compression, system is vulnerable.Check Version:
nats-server --versionVerify Fix Applied:
Verify version is 2.11.2+ or 2.12.3+ and test WebSocket compression handling with large messages📡 Detection & Monitoring
Log Indicators:
- Server process termination logs
- Out of memory errors
- Unusual WebSocket connection patterns
Network Indicators:
- High volume of compressed WebSocket messages from single source
- Rapid memory consumption spikes
SIEM Query:
source="nats-server" AND ("out of memory" OR "panic" OR "fatal")