CVE-2026-33219 — Allocation of Resources Without Limits or Throttling in Nats-io Nats-server V2
Severity
5.3MEDIUMNVD
GHSA7.5OSV7.5
EPSS
0.1%
top 71.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedMar 25
Latest updateMar 26
Description
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a malicious client which can connect to the WebSockets port can cause unbounded memory use in the nats-server before authentication; this requires sending a corresponding amount of data. This is a milder variant of CVE-2026-27571. That earlier issue was a compression bomb, this vulnerability is not. Attacks against this new issue thus require significant client ba…
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4
Affected Packages4 packages
🔴Vulnerability Details
4OSV▶
NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server↗2026-03-26