GHSA-8r68-gvr4-jh7j

Suggest an improvement
Source
https://github.com/advisories/GHSA-8r68-gvr4-jh7j
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-8r68-gvr4-jh7j/GHSA-8r68-gvr4-jh7j.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-8r68-gvr4-jh7j
Aliases
Downstream
CGA (58)
MINI (7)
Related
Published
2026-03-24T21:46:31Z
Modified
2026-07-17T21:02:18Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
NATS is vulnerable to pre-auth DoS through WebSockets client service
Details

Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The nats-server offers a WebSockets client service, used in deployments where browsers are the NATS clients.

Problem Description

A malicious client which can connect to the WebSockets port can cause unbounded memory use in the nats-server before authentication; this requires sending a corresponding amount of data.

This is a milder variant of NATS-advisory-ID 2026-02 (aka CVE-2026-27571; GHSA-qrvq-68c2-7grw). That earlier issue was a compression bomb, this vulnerability is not. Attacks against this new issue thus require significant client bandwidth.

Affected Versions

Any version before v2.12.6 or v2.11.15

Workarounds

Disable websockets if not required for project deployment.

Database specific 
{
    "cwe_ids":  [
        "CWE-770"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-24T21:46:31Z",
    "nvd_published_at":  "2026-03-25T20:16:32Z",
    "severity":  "MODERATE"
}
References

Affected packages

Go / github.com/nats-io/nats-server/v2

Package

Name
github.com/nats-io/nats-server/v2
View open source insights on deps.dev
Purl
pkg:golang/github.com/nats-io/nats-server/v2

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.11.15

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-8r68-gvr4-jh7j/GHSA-8r68-gvr4-jh7j.json"

Go / github.com/nats-io/nats-server/v2

Package

Name
github.com/nats-io/nats-server/v2
View open source insights on deps.dev
Purl
pkg:golang/github.com/nats-io/nats-server/v2

Affected ranges

Type
SEMVER
Events
Introduced
2.12.0-RC.1
Fixed
2.12.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-8r68-gvr4-jh7j/GHSA-8r68-gvr4-jh7j.json"

Go / github.com/nats-io/nats-server

Package

Name
github.com/nats-io/nats-server
View open source insights on deps.dev
Purl
pkg:golang/github.com/nats-io/nats-server

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-8r68-gvr4-jh7j/GHSA-8r68-gvr4-jh7j.json"