CVE-2026-27889

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.2.0 and prior to versions 2.11.14 and 2.12.5, a missing sanity check on a WebSockets frame could trigger a server panic in the nats-server. This happens before authentication, and so is exposed to anyone who can connect to the websockets port. Versions 2.11.14 and 2.12.5 contains a fix. A workaround is available. The vulnerability only affects deployments which use WebSockets and which expose the network port to untrusted end-points. If one is able to do so, a defense in depth of restricting either of these will mitigate the attack.

• CWE-190
• CWE-1286

• https://advisories.nats.io/CVE/secnote-2026-03.txtMitigation, Vendor Advisory
• https://github.com/nats-io/nats-server/security/advisories/GHSA-pq2q-rcw4-3hr6Mitigation, Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:21769
• https://access.redhat.com/errata/RHSA-2026:22347
• https://access.redhat.com/errata/RHSA-2026:23345
• https://access.redhat.com/security/cve/CVE-2026-27889
• https://bugzilla.redhat.com/show_bug.cgi?id=2451447
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27889.json

Published

Mar 25, 2026

Last Modified

Aug 10, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27883Coolify is an open-source and self-hostable tool for managin…5
• CVE-2026-27884NetExec is a network execution tool. Prior to version 1.5.1,…5.3
• CVE-2026-27885Piwigo is an open source photo gallery application for the w…7.2
• CVE-2026-27886Strapi is an open source headless content management system.…7.5
• CVE-2026-27887Spin is an open source developer tool for building and runni…6.9
• CVE-2026-27888pypdf is a free and open-source pure-python PDF library. Pri…7.5
• CVE-2026-2789Use-after-free in the Graphics: ImageLib component. This vul…9.8
• CVE-2026-27890Firebird is an open-source relational database management sy…8.2
• CVE-2026-27891FacturaScripts is an open source accounting and invoicing so…7.2
• CVE-2026-27892FacturaScripts is an open source accounting and invoicing so…6.5
• CVE-2026-27893vLLM is an inference and serving engine for large language m…8.8
• CVE-2026-27894LDAP Account Manager (LAM) is a webfrontend for managing ent…8.8