Read the docs
TI-2026-22233 Aliases CVE-2026-27889GHSA-pq2q-rcw4-3hr6

NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead

Priority HIGH 72CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-190 and the CVSS impact.

Summary

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.2.0 and prior to versions 2.11.14 and 2.12.5, a missing sanity check on a WebSockets frame could trigger a server panic in the nats-server. This happens before authentication, and so is exposed to anyone who can connect to the websockets port. Versions 2.11.14 and 2.12.5 contains a fix. A workaround is available. The vulnerability only affects deployments which use WebSockets and which expose the network port to untrusted end-points. If one is able to do so, a defense in depth of restricting either of these will mitigate the attack.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00593 48th percentileScored 2026-11-07
Fix Fixed nats-server (nats-io): 2.11.14, 2.12.5github.com/nats-io/nats-server/v2 (Go): 2.11.14, 2.12.5Red Hat: 3 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstagenats-server2.2.0 to before 2.11.14; 2.12.0 to before 2.12.52.11.14, 2.12.5Patch availableCNA
—github.com/nats-io/nats-server/v2 (Go)2.2.0 to before 2.11.142.11.14Patch availableGHSA-pq2q-rcw4-3hr6
—github.com/nats-io/nats-server/v2 (Go)2.12.0 to before 2.12.52.12.5Patch availableGHSA-pq2q-rcw4-3hr6
—github.com/nats-io/nats-server (Go)all versions—No fix listedGHSA-pq2q-rcw4-3hr6
  • nats-server Vendorbackstage Affected 2.2.0 to before 2.11.14; 2.12.0 to before 2.12.5 Fixed in 2.11.14, 2.12.5 Patch available CNA
  • github.com/nats-io/nats-server/v2 (Go) Vendor— Affected 2.2.0 to before 2.11.14 Fixed in 2.11.14 Patch available GHSA-pq2q-rcw4-3hr6
  • github.com/nats-io/nats-server/v2 (Go) Vendor— Affected 2.12.0 to before 2.12.5 Fixed in 2.12.5 Patch available GHSA-pq2q-rcw4-3hr6
  • github.com/nats-io/nats-server (Go) Vendor— Affected all versions Fixed in — No fix listed GHSA-pq2q-rcw4-3hr6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*2.2.0 to before 2.11.14; 2.12.0 to before 2.12.5Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:* Versions 2.2.0 to before 2.11.14; 2.12.0 to before 2.12.5 Vulnerable ·backstage

Remediation

  • Fix · CNA nats-server (nats-io) Fixed in 2.11.14, 2.12.5
  • Fix · GHSA-pq2q-rcw4-3hr6 github.com/nats-io/nats-server/v2 (Go) Fixed in 2.11.14 Advisory →
  • Fix · GHSA-pq2q-rcw4-3hr6 github.com/nats-io/nats-server/v2 (Go) Fixed in 2.12.5 Advisory →

Red Hat 3 advisories

  • RHSA-2026:23345 Released 2026-06-04 · Red Hat rating Important
    Multicluster Global Hub 1.6.2 security update
    • Multicluster Global Hub 1.6.6 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:22347 Released 2026-06-01 · Red Hat rating Important
    Multicluster Global Hub 1.4.5 security update
    • Multicluster Global Hub 1.4.9 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:21769 Released 2026-05-28 · Red Hat rating Important
    Multicluster Global Hub 1.5.4 security update
    • Multicluster Global Hub 1.5.8 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Multicluster Global Hub 1.4.9Fixed RHSA-2026:22347
Multicluster Global Hub 1.6.5Fixed RHSA-2026:23345
Red Hat multicluster global hub 1.5.3Fixed RHSA-2026:21769
Not affected: 4 products
  • Multicluster Global Hub 1.4.9
  • Multicluster Global Hub 1.6.5
  • Red Hat OpenShift Container Platform 4
  • Red Hat multicluster global hub 1.5.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27889
  2. 2026-10-03 Alias added: GHSA-pq2q-rcw4-3hr6
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Advisory 3

Other 1

  • TI-2022-11116 NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended… CVSS 3.1CRITICAL 9.8
  • TI-2020-16319 The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of… CVSS 3.1CRITICAL 9.8
  • TI-2026-25637 NATS has MQTT plaintext password disclosure CVSS 3.1HIGH 8.6
  • TI-2022-08320 NATS nats-server before 2.7.2 has Incorrect Access Control. CVSS 3.1HIGH 8.8
  • TI-2026-41950 NATS Server: Pre-auth server crash via double INFO in leafnode handshake CVSS 3.1HIGH 7.5
  • TI-2026-41920 NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory CVSS 3.1HIGH 7.5
See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences