NATS

v2.12.14Networking & Messaging

Jul 30, 2026Copy link

NATS v2.12.14 is a maintenance release fixing two authentication vulnerabilities (TLS verify_and_map bypass with blank passwords, and no_auth_user with auth callouts skipping checks), correcting queue subscription permission enforcement, and addressing dozens of JetStream and MQTT bugs affecting clustering, replication, MQTT QoS, JWT validation, and filestore operations. Performance gains include faster AVL operations and better block cache memory recycling.

• securityTLS verify_and_map authentication bypass with blank passwords fixed

  Users authenticating via TLS verify_and_map must ensure passwords are set; a blank password now fails authentication. This fix ships in v2.12.14 and applies where TLS verify_and_map is used.

• securityno_auth_user with auth callouts no longer skips authentication checks

  When no_auth_user is combined with auth callouts, the server previously skipped authentication checks if no CONNECT message arrived; this no longer occurs. The fix ships in v2.12.14 and applies to deployments combining no_auth_user with external auth callouts.

• breakingQueue subscription permission enforcement corrected

  Several code paths that enforce queue subscription permissions previously treated the entire permission as a subject literal, allowing unintended matches. This is corrected in v2.12.14.

• enhancementDisk concurrency semaphore increased; max_concurrent_io option added

  The disk concurrency semaphore default is now 4096 slots, raised from the previous CPU-scaled value. This can be tuned via the max_concurrent_io option in the jetstream config block.