NATS-Server versions prior to 2.11.15 and 2.12.6 contain a CWE-770 vulnerability where a malicious client connected to the WebSockets port can cause unbounded memory allocation before authentication by sending large volumes of data. This resource exhaustion can lead to denial of service by making the server unavailable to legitimate users. Unlike the related CVE-2026-27571, this issue is not a compression bomb but still requires significant bandwidth from the attacker. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impacts availability only. Red Hat advisories confirm the vulnerability and note that mitigation options are limited, recommending upgrading to fixed versions or disabling WebSockets if not needed.

The vulnerability allows an unauthenticated attacker with network access to the WebSockets port to cause unbounded memory consumption on the nats-server, leading to denial of service by exhausting server resources. There is no impact on confidentiality or integrity, only availability is affected. Exploitation requires significant client bandwidth. No known exploits are reported in the wild.

A fix is available in nats-server versions 2.11.15 and 2.12.6. Users should upgrade to these or later versions to remediate the vulnerability. If upgrading is not immediately possible, disabling the WebSockets port can serve as a workaround to prevent exploitation. Red Hat advisories indicate that no other effective mitigations meet their criteria, so patching or disabling WebSockets are the primary recommended actions.