CVE-2026-27571 Overview
CVE-2026-27571 is a denial of service vulnerability in NATS-Server, a high-performance server for the NATS.io cloud and edge native messaging system. The vulnerability exists in the WebSocket message handling implementation where compressed messages are processed via negotiated WebSocket compression. The implementation fails to independently bound memory consumption during the construction of NATS messages from compressed data streams, allowing attackers to exploit compression bombs to cause excessive memory consumption and crash the server process.
Critical Impact
Unauthenticated attackers can exploit this vulnerability to crash NATS-Server instances by sending specially crafted compressed WebSocket messages, causing operating system-level process termination due to memory exhaustion.
Affected Products
- NATS-Server versions prior to 2.11.2
- NATS-Server versions prior to 2.12.3
- Deployments using WebSocket connections exposed to untrusted endpoints
Discovery Timeline
- 2026-02-24 - CVE CVE-2026-27571 published to NVD
- 2026-02-26 - Last updated in NVD database
Technical Details for CVE-2026-27571
Vulnerability Analysis
This vulnerability is classified under CWE-409 (Improper Handling of Highly Compressed Data) and represents a resource exhaustion attack vector. The NATS-Server WebSocket handler processes compressed messages through negotiated compression, but while the implementation enforces size bounds on the final NATS message, it fails to limit memory consumption during the decompression phase itself.
The core issue lies in the memory stream construction process. When a compressed WebSocket frame arrives, the server attempts to decompress it before validating the resulting message size. An attacker can craft a compression bomb—a small payload that expands dramatically when decompressed—causing the server to allocate excessive memory before the size validation check can reject the oversized message.
Critically, WebSocket compression is negotiated before authentication occurs in the NATS protocol. This means exploitation does not require valid NATS credentials, significantly lowering the barrier for attack. Any deployment exposing WebSocket ports to untrusted networks is vulnerable regardless of authentication configuration.
Root Cause
The root cause is improper handling of highly compressed data (CWE-409) in the WebSocket decompression logic. The implementation validated the size of the constructed NATS message after decompression completed, rather than enforcing limits during the decompression process itself. This allowed unbounded memory allocation when processing maliciously crafted compressed frames that had high compression ratios.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:
- Establishing a WebSocket connection to the NATS-Server
- Negotiating compression during the WebSocket handshake (occurs before authentication)
- Sending a specially crafted compression bomb payload
- The server attempts to decompress the payload, consuming excessive memory
- The operating system terminates the server process due to memory exhaustion
The vulnerability specifically affects deployments where WebSocket ports are exposed to untrusted endpoints.
"strconv"
"strings"
"sync"
+ "sync/atomic"
"time"
"unicode/utf8"
Source: GitHub Commit f77fb7c
The fix introduces atomic operations to track and limit buffer size during frame decompression, failing fast once the decompressed data exceeds the allowable message size rather than continuing decompression.
Detection Methods for CVE-2026-27571
Indicators of Compromise
- Sudden server process termination with out-of-memory conditions in system logs
- Abnormally high memory utilization on NATS-Server processes preceding crashes
- WebSocket connections from untrusted sources with unusual compression ratios
- Repeated server restarts without corresponding legitimate traffic spikes
Detection Strategies
- Monitor NATS-Server process memory usage for rapid, unexplained growth patterns
- Implement network-level monitoring for WebSocket connections to NATS ports from untrusted sources
- Review system logs (dmesg, journalctl) for OOM killer events targeting nats-server processes
- Deploy application-level logging to track WebSocket connection establishment and compression negotiation
Monitoring Recommendations
- Set memory utilization alerts for NATS-Server processes with aggressive thresholds
- Monitor for repeated process restarts which may indicate ongoing exploitation attempts
- Implement network traffic analysis to detect compressed payloads with anomalous size ratios
- Enable detailed WebSocket connection logging to identify suspicious connection patterns
How to Mitigate CVE-2026-27571
Immediate Actions Required
- Upgrade NATS-Server to version 2.11.2 or later for the 2.11.x branch
- Upgrade NATS-Server to version 2.12.3 or later for the 2.12.x branch
- Restrict WebSocket port access to trusted networks only if immediate patching is not possible
- Review firewall rules to ensure NATS WebSocket endpoints are not exposed to untrusted sources
Patch Information
The vulnerability has been addressed in NATS-Server versions 2.11.2 and 2.12.3. The fix bounds the decompression operation to fail immediately once the message exceeds size limits, preventing unbounded memory allocation. Security patches are available through the official NATS-Server GitHub releases:
For detailed information, refer to the GitHub Security Advisory GHSA-qrvq-68c2-7grw.
Workarounds
- Place NATS-Server WebSocket endpoints behind a reverse proxy that can filter compressed traffic
- Disable WebSocket support entirely if not required for your deployment
- Implement network segmentation to ensure WebSocket ports are only accessible from trusted internal networks
- Deploy rate limiting on WebSocket connections to slow potential exploitation attempts
# Example: Restrict WebSocket access using iptables
# Allow WebSocket traffic only from trusted subnet
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
