NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling of NATS messages handles compressed messages via the WebSockets negotiated compression. Prior to versions 2.11.2 and 2.12.3, the implementation bound the memory size of a NATS message but did not independently bound the memory consumption of the memory stream when constructing a NATS message which might then fail validation for size reasons. An attacker can use a compression bomb to cause excessive memory consumption, often resulting in the operating system terminating the server process. The use of compression is negotiated before authentication, so this does not require valid NATS credentials to exploit. The fix, present in versions 2.11.2 and 2.12.3, was to bounds the decompression to fail once the message was too large, instead of continuing on. The vulnerability only affects deployments which use WebSockets and which expose the network port to untrusted end-points.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The
    WebSockets handling of NATS messages handles compressed messages via the WebSockets negotiated
    compression. Prior to versions 2.11.2 and 2.12.3, the implementation bound the memory size of a NATS
    message but did not independently bound the memory consumption of the memory stream when constructing a
    NATS message which might then fail validation for size reasons. An attacker can use a compression bomb to
    cause excessive memory consumption, often resulting in the operating system terminating the server
    process. The use of compression is negotiated before authentication, so this does not require valid NATS
    credentials to exploit. The fix, present in versions 2.11.2 and 2.12.3, was to bounds the decompression to
    fail once the message was too large, instead of continuing on. The vulnerability only affects deployments
    which use WebSockets and which expose the network port to untrusted end-points. (CVE-2026-27571)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The     WebSockets handling of NATS messages handles compressed messages via the WebSockets negotiated     compression. Prior to versions 2.11.2 and 2.12.3, the implementation bound the memory size of a NATS     message but did not independently bound the memory consumption of the memory stream when constructing a     NATS message which might then fail validation for size reasons. An attacker can use a compression bomb to     cause excessive memory consumption, often resulting in the operating system terminating the server     process. The use of compression is negotiated before authentication, so this does not require valid NATS     credentials to exploit. The fix, present in versions 2.11.2 and 2.12.3, was to bounds the decompression to     fail once the message was too large, instead of continuing on. The vulnerability only affects deployments     which use WebSockets and which expose the network port to untrusted end-points. (CVE-2026-27571)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
464089	Echo: github.com/nats-io/nats-server/v2: security update to 2.11.12	Tenable Cloud Security	Echo Local Security Checks	Local	high
464089	Echo: github.com/nats-io/nats-server/v2: security update to 2.11.12	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
299911	Linux Distros Unpatched Vulnerability : CVE-2026-27571	Nessus	Misc.	Local	high
437951	SCA: security update for github.com/nats-io/nats-server/v2 (GHSA-qrvq-68c2-7grw)	Tenable Cloud Security	SCA Checks	Local	high
437951	SCA: security update for github.com/nats-io/nats-server/v2 (GHSA-qrvq-68c2-7grw)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-27571

high

Tenable Plugins

high

high

high

high

high