CVE-2026-27889: CWE-190: Integer Overflow or Wraparound in nats-io nats-server
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.2.0 and prior to versions 2.11.14 and 2.12.5, a missing sanity check on a WebSockets frame could trigger a server panic in the nats-server. This happens before authentication, and so is exposed to anyone who can connect to the websockets port. Versions 2.11.14 and 2.12.5 contains a fix. A workaround is available. The vulnerability only affects deployments which use WebSockets and which expose the network port to untrusted end-points. If one is able to do so, a defense in depth of restricting either of these will mitigate the attack.
AI Analysis
Technical Summary
The nats-server component of nats-io has an integer overflow or wraparound vulnerability (CWE-190) triggered by a missing sanity check on WebSockets frames. This vulnerability can cause the server to panic before authentication, allowing unauthenticated attackers who can connect to the WebSockets port to disrupt service. The issue affects versions >=2.2.0 and <2.11.14 and <2.12.5. The vulnerability is mitigated by patching to versions 2.11.14 or 2.12.5 or later. Additionally, restricting WebSockets usage or limiting network exposure to trusted endpoints provides defense in depth. The CVSS 3.1 base score is 7.5 (High), reflecting a network attack vector with no privileges required and no user interaction, causing high impact on availability.
Potential Impact
Successful exploitation causes a server panic resulting in denial of service (availability impact). The vulnerability is exploitable remotely without authentication via the WebSockets port. There is no impact on confidentiality or integrity. The vulnerability affects service availability for deployments exposing the WebSockets port to untrusted networks.
Mitigation Recommendations
A fix is available in nats-server versions 2.11.14 and 2.12.5. Deployments should upgrade to these or later versions to remediate the vulnerability. As a workaround, restrict or disable WebSockets usage or limit network exposure of the WebSockets port to trusted endpoints only. These mitigations reduce the attack surface and prevent unauthenticated attackers from triggering the vulnerability.
CVE-2026-27889: CWE-190: Integer Overflow or Wraparound in nats-io nats-server
Description
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.2.0 and prior to versions 2.11.14 and 2.12.5, a missing sanity check on a WebSockets frame could trigger a server panic in the nats-server. This happens before authentication, and so is exposed to anyone who can connect to the websockets port. Versions 2.11.14 and 2.12.5 contains a fix. A workaround is available. The vulnerability only affects deployments which use WebSockets and which expose the network port to untrusted end-points. If one is able to do so, a defense in depth of restricting either of these will mitigate the attack.
CVSS v3.1
Score 7.5high
Affected software
pkg:github/nats-io/nats-serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The nats-server component of nats-io has an integer overflow or wraparound vulnerability (CWE-190) triggered by a missing sanity check on WebSockets frames. This vulnerability can cause the server to panic before authentication, allowing unauthenticated attackers who can connect to the WebSockets port to disrupt service. The issue affects versions >=2.2.0 and <2.11.14 and <2.12.5. The vulnerability is mitigated by patching to versions 2.11.14 or 2.12.5 or later. Additionally, restricting WebSockets usage or limiting network exposure to trusted endpoints provides defense in depth. The CVSS 3.1 base score is 7.5 (High), reflecting a network attack vector with no privileges required and no user interaction, causing high impact on availability.
Potential Impact
Successful exploitation causes a server panic resulting in denial of service (availability impact). The vulnerability is exploitable remotely without authentication via the WebSockets port. There is no impact on confidentiality or integrity. The vulnerability affects service availability for deployments exposing the WebSockets port to untrusted networks.
Mitigation Recommendations
A fix is available in nats-server versions 2.11.14 and 2.12.5. Deployments should upgrade to these or later versions to remediate the vulnerability. As a workaround, restrict or disable WebSockets usage or limit network exposure of the WebSockets port to trusted endpoints only. These mitigations reduce the attack surface and prevent unauthenticated attackers from triggering the vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-02-24T15:19:29.716Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-27889","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:22347","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:21769","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:23345","vendor":"Red Hat"}]
Threat ID: 69c43b99f4197a8e3b7c5650
Added to database: 03/25/2026, 19:46:33 UTC
Last enriched: 07/30/2026, 01:37:51 UTC
Last updated: 07/31/2026, 19:30:22 UTC
Views: 104
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.