RATATOSKRATATOSK
Sign in

NATS

v2.14.4Networking & Messaging
Jul 30, 2026

NATS v2.14.4 fixes three authentication/authorization flaws (TLS verify_and_map blank-password bypass, no_auth_user auth callout bypass, MQTT $MQTT.> subscription permission bypass) plus a substantial set of JetStream and MQTT reliability and performance improvements including Raft cluster fixes, optimized sequence operations, and tunable disk concurrency.

  • securityTLS verify_and_map blank-password bypass fixed

    TLS `verify_and_map` authentication would accept users with blank passwords, bypassing password checks. The fix ships in v2.14.4 and applies wherever `verify_and_map` is configured.

  • securityno_auth_user auth callout bypass fixed

    When `no_auth_user` is combined with auth callouts and a client omits a `CONNECT` message, authentication checks were skipped. The fix ships in v2.14.4 and applies to deployments using both `no_auth_user` and auth callouts.

  • securityMQTT $MQTT.> subscription permission bypass closed

    MQTT clients could subscribe to `$MQTT.>` subjects to bypass permission restrictions. The fix ships in v2.14.4 and applies unconditionally to all MQTT deployments.

  • enhancementJetStream disk concurrency tunable added

    The disk concurrency semaphore default has been raised to 4096 slots from a CPU-scaled count. Deployments can now tune JetStream I/O concurrency via the new `max_concurrent_io` option in the jetstream config block.

Key changes (8)

  • Security: TLS verify_and_map blank-password bypass (applies if verify_and_map configured)
  • Security: no_auth_user + auth callout bypass when CONNECT is omitted (applies if both configured)
  • Security: MQTT $MQTT.> subscription permission bypass closed
  • JetStream disk concurrency semaphore raised to 4096 slots (tunable via new max_concurrent_io option)
  • JetStream performance: stream snapshots pre-compute buffer size, sequence lookups optimized, filestore block cache recycled to pool
  • JetStream reliability: Raft/cluster decoder fixes for malformed replicated acks/updates, encryption key file syncing, message removal race conditions
  • MQTT reliability: QoS1/QoS2 packet identifiers now monotonic, delivery leaks on QoS downgrade fixed
  • Multiple fixes: JWT validation crash on whitespace-only permissions, queue subscription permission enforcement, null JSON value crashes, healthz/varz endpoint issues
Add NATS to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.

Add to stack →
Source ↗All NATS releases →