CVE WatchJul 15, 2026

CVE-2026-33219

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a mali

CVSS

5.3

Medium

EPSS

0.5%

p41

KEV

—

Exploit Today

0-100

Published: Mar 25, 2026 · Last modified: Jul 15, 2026 · CWE-770

EPSS · 30d

0.5%EPSS · 30 days0.5%

2026-06-302026-07-17

Technical description

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a malicious client which can connect to the WebSockets port can cause unbounded memory use in the nats-server before authentication; this requires sending a corresponding amount of data. This is a milder variant of CVE-2026-27571. That earlier issue was a compression bomb, this vulnerability is not. Attacks against this new issue thus require significant client bandwidth. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, disable websockets if not required for project deployment.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-217107.5 HIG

97.8%

——29A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**3d CVE-2026-261307.5 HIG

85.0%

——25Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.3d CVE-2026-489337.5 HIG

84.9%

——25A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.2d CVE-2026-455917.5 HIG

82.4%

——25Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.3d CVE-2021-366307.5 HIG

80.5%

——24DDOS reflection amplification vulnerability in eAut module of Ruckus Wireless SmartZone controller that allows remote attackers to perform DOS attacks via crafted request.9d CVE-2025-97847.5 HIG

80.3%

——24A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).18d