CVE-2026-27571: 
NixOS vulnerability analysis and mitigation

CVE-2026-27571 is a pre-authentication memory denial-of-service (DoS) vulnerability in the NATS server's WebSockets message handling, caused by improper handling of compression bombs. An unauthenticated remote attacker can send a specially crafted compressed WebSocket frame that, upon decompression, consumes excessive memory and causes the operating system to terminate the server process. Affected versions include nats-server v2 prior to 2.11.12 and versions 2.12.0-RC.1 through 2.12.3 (fixed in 2.12.3); the legacy v1 series (≤ 1.4.1) has no patch available. The vulnerability was published on February 23, 2026, and assigned a CVSS v3.1 base score of 5.9 (Medium) by the GitHub Advisory, though Feedly's NVD-sourced score is 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-409 (Improper Handling of Highly Compressed Data) and CWE-770 (Allocation of Resources Without Limits or Throttling). When a WebSocket client negotiates per-message compression (RFC 7692), the NATS server's decompress() function used io.ReadAll() without any size limit on the decompressed output buffer — it only validated the NATS message size after full decompression. An attacker can craft a WebSocket frame containing highly compressed data (a compression bomb, e.g., 100 MB of zeros compressed to a few kilobytes) that expands to an arbitrarily large buffer during decompression, exhausting server memory. Because WebSocket compression is negotiated during the handshake phase — before any NATS authentication — no valid credentials are required to trigger this condition. The fix (commit f77fb7c) wraps the decompressor in an io.LimitedReader bounded by the server's configured max_payload size, returning ErrMaxPayload and disconnecting the client if the limit is exceeded (GitHub Commit, GitHub Advisory).

Successful exploitation results in complete loss of availability for the NATS server process — the operating system typically terminates the process due to out-of-memory conditions. There is no confidentiality or integrity impact; the attack is purely a denial-of-service. Any application or microservice relying on the affected NATS server for messaging would be disrupted for the duration of the attack, and repeated exploitation could prevent service recovery (GitHub Advisory, Red Hat Bugzilla).

No public exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.033–0.055%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the pre-authentication nature of the attack (no credentials required) and the straightforward compression bomb technique make it relatively easy to weaponize against exposed WebSocket endpoints. The vulnerability was reported by Pavel Kohout of Aisle Research (GitHub Advisory).

1. Reconnaissance: Identify NATS server instances with WebSocket support enabled and the WebSocket port exposed to untrusted networks (default or custom port, often 443 or 8080 for WebSockets). Tools like Shodan or Censys can be used to locate exposed endpoints.
2. Establish WebSocket connection: Connect to the NATS server's WebSocket endpoint and negotiate per-message deflate compression during the WebSocket handshake (RFC 7692), which is accepted before any authentication challenge.
3. Craft compression bomb payload: Create a highly compressed WebSocket binary frame containing, for example, 100 MB of zero bytes compressed with DEFLATE to a few kilobytes. Set the RSV1 bit in the WebSocket frame header to indicate per-message compression.
4. Send malicious frame: Transmit the crafted compressed frame to the server. The vulnerable server will attempt to fully decompress the payload using io.ReadAll() without a size limit, allocating a massive memory buffer.
5. Trigger OOM termination: The server's memory consumption spikes rapidly; the OS OOM killer terminates the NATS server process, causing a denial of service for all connected clients and dependent services (GitHub Commit, GitHub Advisory).

• Network: Unexpected WebSocket connections to the NATS WebSocket port from untrusted or unknown IP addresses; large compressed WebSocket frames (small wire size but triggering high memory usage) arriving in rapid succession.
• Logs: NATS server logs showing abrupt process termination or OOM-related errors; OS-level kernel logs (dmesg) containing OOM killer entries referencing the nats-server process (e.g., Out of memory: Kill process <pid> (nats-server)).
• Process: Sudden disappearance of the nats-server process without a graceful shutdown signal; monitoring alerts for process restarts or watchdog triggers on the NATS service.
• System: Rapid spike in system memory consumption correlated with WebSocket traffic to the NATS port, visible in tools like top, htop, or system memory metrics (GitHub Advisory, GitHub Commit).

Upgrade nats-server to version 2.11.12 (v2.11 series) or 2.12.3 (v2.12 series), which bound decompression size using io.LimitedReader tied to the server's max_payload configuration. For the legacy v1 series (≤ 1.4.1), no patch is available and migration to v2 is recommended. As a workaround, deployments that do not require WebSocket support should disable the WebSocket listener entirely, or restrict WebSocket port access to trusted networks/clients only using firewall rules — this vulnerability only affects deployments with WebSockets enabled and the port exposed to untrusted endpoints (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported to NATS maintainers by Pavel Kohout of Aisle Research and was initially released as a regular fix without security highlighting — the NATS team later acknowledged this as an oversight and assigned a CVE per their security policy for pre-authentication issues. Red Hat tracked the issue via Bugzilla and assessed it as medium severity. Microsoft also referenced the CVE in the context of affected Telegraf packages (CBL-2 and AZL-3 distributions). No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified (GitHub Advisory, Red Hat Bugzilla, Microsoft MSRC).