CVE-2026-27889 nats-io CVE debrief

Who should care

Defenders and administrators of NATS-Server deployments using WebSockets and exposing ports to untrusted endpoints should assess exposure and prioritize patching or mitigation. This includes operators, security teams, and vulnerability management teams responsible for ensuring the security and integrity of their systems.

Why it matters

CVE-2026-27889 is a high-severity vulnerability in NATS-Server that can cause a server panic via a specially crafted WebSockets frame. Defenders should prioritize patching or mitigating this vulnerability, especially in deployments using WebSockets and exposing ports to untrusted endpoints. The vulnerability is confirmed in versions 2.2.0 to 2.11.13 and 2.12.0 to 2.12.4, and a fix is available in versions 2.11.14 and 2.12.5.

• Potential server panic and denial of service
• Exposure to untrusted endpoints before authentication
• Need for patching or restricting WebSockets port access
• Verification of current version and exposure required

Technical summary

The NATS-Server is vulnerable to a server panic due to a missing sanity check on WebSockets frames. This issue affects versions 2.2.0 to 2.11.13 and 2.12.0 to 2.12.4. The vulnerability is triggered before authentication and is exposed to anyone who can connect to the WebSockets port. The vulnerability only affects deployments which use WebSockets and which expose the network port to untrusted end-points. A fix is available in versions 2.11.14 and 2.12.5, and a workaround is provided. Defenders should prioritize patching or mitigating this vulnerability, especially in deployments using WebSockets and exposing ports to untrusted endpoints.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in deployments using WebSockets and exposing ports to untrusted endpoints.

Recommended defensive actions

• Patch NATS-Server to version 2.11.14 or 2.12.5
• Restrict access to WebSockets port to trusted endpoints
• Implement workaround as described in vendor advisory
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed in NATS-Server versions 2.2.0 to 2.11.13 and 2.12.0 to 2.12.4. A fix is available in versions 2.11.14 and 2.12.5. Defenders should verify current version and exposure, and review compensating controls for exposed systems. The vulnerability only affects deployments which use WebSockets and which expose the network port to untrusted end-points.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.