CVE-2026-33219: NATS-Server WebSocket DoS Vulnerability

CVE-2026-33219 Overview

CVE-2026-33219 is a resource exhaustion vulnerability in NATS-Server, a high-performance server for the NATS.io cloud and edge native messaging system. This vulnerability allows a malicious client connected to the WebSockets port to cause unbounded memory consumption before authentication occurs. The attack requires sending a corresponding amount of data to trigger memory growth, making this a milder variant of the earlier CVE-2026-27571 compression bomb vulnerability. Unlike the previous issue, this vulnerability is not a compression bomb and requires significant client bandwidth to exploit effectively.

Critical Impact

Unauthenticated attackers with network access to the WebSockets port can exhaust server memory resources, potentially causing denial of service conditions in NATS messaging infrastructure.

Affected Products

• NATS-Server versions prior to 2.11.15
• NATS-Server versions prior to 2.12.6
• Linux Foundation NATS-Server deployments with WebSockets enabled

Discovery Timeline

• 2026-03-25 - CVE-2026-33219 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33219

Vulnerability Analysis

This vulnerability falls under CWE-770 (Allocation of Resources Without Limits or Throttling). The flaw exists in the NATS-Server's WebSocket connection handling logic, where incoming data from unauthenticated clients can trigger unbounded memory allocation. The pre-authentication nature of this vulnerability is particularly concerning as it allows attackers to impact server resources without valid credentials.

The attack surface is limited to environments where WebSockets functionality is enabled and exposed to potentially malicious clients. While the vulnerability requires significant bandwidth from the attacker to be effective (unlike a compression bomb that amplifies small payloads), it still presents a viable denial of service vector for determined adversaries with sufficient network resources.

Root Cause

The root cause lies in insufficient resource allocation controls within the WebSocket connection handling code path. When processing incoming WebSocket data, the NATS-Server fails to properly limit memory allocations for unauthenticated connections, allowing attackers to consume server memory proportional to the amount of data they transmit.

Attack Vector

The attack is network-based and can be executed by any client capable of establishing a WebSocket connection to the vulnerable NATS-Server instance. The attacker does not require authentication, making this a pre-authentication denial of service vulnerability. The attack workflow involves:

1. Establishing a WebSocket connection to the target NATS-Server
2. Transmitting large volumes of data before completing authentication
3. Server memory grows unboundedly in response to incoming data
4. Continued transmission eventually exhausts available memory resources

For detailed technical information about the vulnerability mechanism, refer to the NATS Security Notice 2026-11 and the GitHub Security Advisory.

Detection Methods for CVE-2026-33219

Indicators of Compromise

• Unusual memory growth on NATS-Server processes without corresponding increase in authenticated client activity
• High volume of WebSocket connections from single or few IP addresses
• Abnormal incoming data volume on WebSocket ports without successful authentication completions
• Server memory exhaustion or out-of-memory errors in NATS-Server logs

Detection Strategies

• Monitor NATS-Server process memory consumption for anomalous growth patterns
• Implement connection rate limiting and bandwidth monitoring on WebSocket endpoints
• Track authentication failure rates alongside resource consumption metrics
• Deploy network intrusion detection rules to identify high-volume WebSocket traffic from suspicious sources

Monitoring Recommendations

• Configure alerting thresholds for NATS-Server memory usage to detect early signs of resource exhaustion attacks
• Implement logging for all WebSocket connection attempts, particularly those that fail to authenticate
• Monitor network traffic patterns to identify sustained high-bandwidth connections to WebSocket ports
• Use application performance monitoring to correlate memory growth with connection activity

How to Mitigate CVE-2026-33219

Immediate Actions Required

• Upgrade NATS-Server to version 2.11.15 or 2.12.6 or later immediately
• Disable WebSockets functionality if not required for your deployment
• Implement network-level access controls to restrict WebSocket port access to trusted clients
• Monitor memory consumption on existing NATS-Server instances until patches can be applied

Patch Information

The NATS maintainers have released fixed versions that address this vulnerability. Organizations should upgrade to NATS-Server version 2.11.15 for the 2.11.x branch or version 2.12.6 for the 2.12.x branch. Detailed patch information is available in the NATS Security Notice 2026-02 and the GitHub NATS Server Advisory.

Workarounds

• Disable WebSockets if not required for your project deployment by removing or commenting out WebSocket configuration
• Implement firewall rules to restrict access to WebSocket ports from untrusted networks
• Deploy a reverse proxy or load balancer with connection rate limiting in front of NATS-Server
• Use network segmentation to isolate NATS-Server instances from potentially hostile network traffic

# Example: Disable WebSockets in NATS Server configuration
# Comment out or remove the websocket block in nats-server.conf
# websocket {
#   port: 8080
#   no_tls: true
# }

# Alternatively, restart nats-server without websocket configuration
nats-server -c /path/to/config-without-websockets.conf