CVE-2026-27889

High

Advisory

Published 25 Mar 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.006; 46th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 51; of 17,781 indexed, latest versions
Container images: 42; deployed by those charts
Fix available: 2 of 2; affected packages

NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead

Carried by container images the latest versions of 51 of 17,781 indexed charts deploy, on 42 images.

Affected package	Affected versions	Fixed in	Images
github.com/nats-io/nats-server/v2golang	v2.2.5, v2.2.6, v2.3.3, v2.7.4+25 more	2.11.14, 2.12.5	41
natsbitnami	2.11.8-0	2.11.14	1

OSV records: BIT-nats-2026-27889 GHSA-pq2q-rcw4-3hr6
Also known as: GO-2026-4841

Charts affected

51 by stars

Chart

Latest

Affected images

Radar Score

nats-account-serverwenerme

0.8.1

1 of 1 See more

nats-account-server wenerme 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-27889.

Container image	Digest	Package	Fixed in
natsio/nats-account-server :1.0.0	a3381560aab6	github.com/nats-io/nats-server/v2@v2.3.3	2.11.14

Open the chart page →

2,634

Container images carrying it

42 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
natsio/nats-box :0.14.1	a67913df95f1	github.com/nats-io/nats-server/v2@v2.9.19	2.11.14	5
natsio/nats-box :0.19.2	8031d190c7ee	github.com/nats-io/nats-server/v2@v2.10.23	2.11.14	3
natsio/nats-box :0.19.7	ffce8bd10338	github.com/nats-io/nats-server/v2@v2.10.27	2.11.14	3
quay.io/devtron/nats-box :latest	48cdd3054b20	github.com/nats-io/nats-server/v2@v2.9.2	2.11.14	3
quay.io/devtron/prometheus-nats-exporter :0.9.0	94044746cbce	github.com/nats-io/nats-server/v2@v2.2.5	2.11.14	3
cs3org/revad :v1.19.0	3b57a34a7dfd	github.com/nats-io/nats-server/v2@v2.8.4	2.11.14	2
cs3org/revad :v1.24.0	e80a4d67b352	github.com/nats-io/nats-server/v2@v2.9.11	2.11.14	2
natsio/nats-account-server :1.0.0	a3381560aab6	github.com/nats-io/nats-server/v2@v2.3.3	2.11.14	2
natsio/nats-box :0.11.0	9fbf7bf684e4	github.com/nats-io/nats-server/v2@v2.7.5-0.20220418055348-79b4374d01d8	2.11.14	2
natsio/prometheus-nats-exporter :0.10.0	16048afb67a5	github.com/nats-io/nats-server/v2@v2.8.4	2.11.14	2
natsio/prometheus-nats-exporter :0.17.3	26c826662ac8	github.com/nats-io/nats-server/v2@v2.11.3	2.11.14	2
natsio/prometheus-nats-exporter :0.11.0	31c02aac089a	github.com/nats-io/nats-server/v2@v2.9.16	2.11.14	2
opencloudeu/opencloud-rolling :2.1.0	f9634bb04905	github.com/nats-io/nats-server/v2@v2.11.0	2.11.14	2
rancher/kine :v0.11.4	12889bbcd1e8	github.com/nats-io/nats-server/v2@v2.10.5	2.11.14	2
aquasec/postee :2.12.0-amd64	0795cba777e7	github.com/nats-io/nats-server/v2@v2.7.4	2.11.14	1
aquasec/postee-ui :2.12.0-amd64	c0467c3941dc	github.com/nats-io/nats-server/v2@v2.7.4	2.11.14	1
bitnamilegacy/nats :2.11.8-debian-12-r0	fa0cfba6034a	nats@2.11.8-0	2.11.14	1
kubeshop/testkube-api-server :2.1.162	e97dc620d9b4	github.com/nats-io/nats-server/v2@v2.11.4	2.11.14	1
kubeshop/testkube-logs-server :latest	094186b19698	github.com/nats-io/nats-server/v2@v2.10.16	2.11.14	1
library/nats :2.12.2-alpine	2d5fce3229ae	github.com/nats-io/nats-server/v2@v2.12.2	2.12.5	1
library/nats :2.12.3-alpine	88fe8e0e09d6	github.com/nats-io/nats-server/v2@v2.12.3	2.12.5	1
library/nats-streaming :0.25.6	0ad6861379c9	github.com/nats-io/nats-server/v2@v2.9.24	2.11.14	1
library/nats-streaming :0.25.5	ced93c701875	github.com/nats-io/nats-server/v2@v2.9.19	2.11.14	1
library/telegraf :1.20.4	28e98eece020	github.com/nats-io/nats-server/v2@v2.2.6	2.11.14	1
library/telegraf :1.27	507a3eecf809	github.com/nats-io/nats-server/v2@v2.9.9	2.11.14	1
library/telegraf :1.19-alpine	addb86c0c520	github.com/nats-io/nats-server/v2@v2.2.6	2.11.14	1
natsio/nats-box :0.14.3	1cc420186664	github.com/nats-io/nats-server/v2@v2.10.12	2.11.14	1
natsio/nats-box :0.13.5	59cf2e949181	github.com/nats-io/nats-server/v2@v2.9.2	2.11.14	1
natsio/nats-box :0.18.0	abdc9f9f0120	github.com/nats-io/nats-server/v2@v2.11.3	2.11.14	1
natsio/nats-box :0.13.3	c507bd7e3831	github.com/nats-io/nats-server/v2@v2.9.6	2.11.14	1
natsio/nats-box :0.14.2	e808e0644ce1	github.com/nats-io/nats-server/v2@v2.9.19	2.11.14	1
natsio/nats-kafka :1.4.2	bb241956b0dc	github.com/nats-io/nats-server/v2@v2.10.5	2.11.14	1
natsio/prometheus-nats-exporter :0.18.0	02469dc907bc	github.com/nats-io/nats-server/v2@v2.11.3	2.11.14	1
natsio/prometheus-nats-exporter :0.13.0	2adf791d9f9f	github.com/nats-io/nats-server/v2@v2.10.3	2.11.14	1
natsio/prometheus-nats-exporter :0.10.1	bce728062c4f	github.com/nats-io/nats-server/v2@v2.8.4	2.11.14	1
owncloud/ocis :7.1.3	88e7c854517d	github.com/nats-io/nats-server/v2@v2.10.22	2.11.14	1
owncloud/ocis :8.0.1	b38fd8fdd58f	github.com/nats-io/nats-server/v2@v2.12.3	2.12.5	1
ghcr.io/aserto-dev/topaz :0.32.59	4c708ecf7dc4	github.com/nats-io/nats-server/v2@v2.11.1	2.11.14	1
ghcr.io/loft-sh/kubernetes :v1.35.0	90097a08b87c	github.com/nats-io/nats-server/v2@v2.12.2	2.12.5	1
ghcr.io/matrix-org/dendrite-monolith :v0.9.4	3267d27d392f	github.com/nats-io/nats-server/v2@v2.8.5-0.20220811224153-d8d25d9b0b1c	2.11.14	1
ghcr.io/openconfig/gnmic :0.45.0	d422a9ebd4a2	github.com/nats-io/nats-server/v2@v2.12.4	2.12.5	1
quay.io/harikube/vcluster-pro :0.32.1	b741efae8d31	github.com/nats-io/nats-server/v2@v2.12.0	2.12.5	1