RATATOSKRATATOSK
Sign in

NATS

v2.14.8Networking & Messaging
Oct 9, 2026

ACTION 1CHECK 2OTHER 53

A maintenance release focused on correctness and performance. It removes a legacy gateway capability and tightens related ingress behavior, alongside fixes across authentication, configuration, routing, and stream handling.

Action needed (1)

  • breakingThe legacy $GR. reply prefix reserved on client ingress

    The legacy $GR. reply prefix is now reserved on client ingress. Clients can no longer publish to gateway reply subjects using that prefix.

Check if affected (2)

  • breakingRemoval of the legacy $GR. reply prefix

    Applies if you use servers prior to v2.1.2.

    Support for sending and handling the legacy $GR. reply prefix, used by servers prior to v2.1.2, has been removed.

  • breakingRemote proxy option validation

    Applies if you configure remote proxy options and do not specify a proxy URL.

    Remote proxy options are now rejected when no proxy URL is specified.

All 53 other recorded changesfixes 39 · value changes 11 · additions 3

fixes (39)

  • - Concurrent account JWT updates no longer invalidate stream imports and interrupt message delivery (#8610)
  • - Configuration reloads no longer incorrectly disconnect operator mode clients that send an nkey (#8609)
  • - Connz requests selecting a connection by cid now correctly apply account, user and MQTT client ID filters (#8613)
  • - Pipelined client operations are no longer processed after a connection is rejected for exceeding the account's max_connections limit (#8614)
  • - Queue subscription deny permissions are now checked against the mapped delivery subject (#8616)
  • - Outstanding reply permissions are now preserved when inherited account permissions are refreshed without changing the response policy (#8620, contributed by @0xasritha)
  • - Subscription deny filters are now rebuilt atomically when inherited account permissions are refreshed, preventing a window in which denied messages could be delivered (#8622, contributed by @0xasritha)
  • - Unquoted configuration values beginning with a number and a size or exponent suffix, such as 0K1abc, are now correctly parsed as strings (#8263, contributed by @koriyoshi2041)
  • - Account JWT updates now reject invalid subject mappings instead of reporting success, and failed replacements no longer remove existing mappings (#8627, contributed by @vulragrag-star)
  • - Cached subscription results are now cleared when an already connected client sends another CONNECT, preventing stale results from being reused after an account change (#8641, reported by @Tan-JunWei)
  • - Fixed several data races affecting service imports and exports during configuration reloads and account updates (#8675)
  • - Per-account routes no longer double count inbound account message and byte statistics (#8677)
  • - TLS certificate pin validation now checks the correct pins after a configuration reload (#8679)
  • - Fast batch ping no longer starts a new batch incorrectly (#8714)
  • - Auth callout rejections are now reported as authentication errors instead of account connection limit errors (#8688, contributed by @aniketatgithub)
  • - Scoped ProxyRequired settings are now respected in JWTs and auth callouts (#8694)
  • - Subscription interest notifications are no longer missed when a subscription is added or removed concurrently (#8703)
  • - Fixed issues with auth callout auth_users bypass
  • - Fixed a PDH counter buffer overflow on Windows
  • - Stream scale-down requests are now rejected when the target replica count has no configured account tier (#8608)
  • - Stale per-message TTL entries are now removed when their messages have already been deleted, avoiding repeated expiry scans and excess CPU and memory usage (#8595, contributed by @digitalstraw)
  • - The maximum deliveries exceeded advisory is now sent correctly when a consumer's max_deliver is lowered below a message's existing delivery count (#8605, contributed by @zeke-lin)
  • - The consumer created time is now preserved after recovery (#8621)
  • - Filestore compaction now respects the configured sync settings when replacing a message block (#8629)
  • - Fixed a race during filestore compaction that could cause consumers to skip messages or lose redelivery tracking (#8623, contributed by @as-clearview)
  • - Concurrent updates to R1 consumers no longer lose API responses (#8628)
  • - Stream and consumer create and delete requests received during metalayer catchup now receive responses once catchup completes (#8643)
  • - R1 consumer create requests no longer lose their responses when the consumer is deleted immediately afterwards (#8643)
  • - Fixed a data race when handling consumer leader stepdown requests (#8647)
  • - Fixed a memory leak affecting pull requests and direct gets after a configuration reload when the system account is explicitly configured in the accounts block (#8650, contributed by @1995parham)
  • - Fixed a panic when shutting down a clustered JetStream server immediately after startup (#8707, contributed by @clwluvw)
  • - Idempotent stream create requests with sources no longer time out after leader changes (#8703)
  • - Recovered ephemeral consumers with inactive_threshold set are now cleaned up properly after a server restart (#8732)
  • - Publish permissions are now checked against the transformed subject sent over the leafnode connection, avoiding the need to also allow the original stream import subject (#8530, contributed by @fbarth-ifr)
  • - Fixed incorrect pending byte accounting after a partial compressed write that could stall a leafnode connection and prevent it from reconnecting (#8636)
  • - Closed leafnode connections are now correctly removed from the account's leafnode list, reducing retained memory and garbage collection pressure (#8637)
  • - Remote proxies no longer incorrectly warn that nats:// URLs are unsupported or lose the hub's initial INFO message (#8701)
  • - Config load no longer breaks QoS1/QoS2 delivery when max_ack_pending is unset (#8671)
  • - MQTT packet lengths are validated earlier against max_payload (#8692)

value changes (11)

  • - 1.26.9 (#8740)
  • - Stalled source and mirror flow control is now reported in stream info and warning logs, making missing $JS.FC.> imports or exports easier to diagnose (#8633)
  • - Stream and consumer placement now prefers peers that have caught up with the metalayer, reducing delays in API responses (#8643)
  • - Improved the performance of deleting entries from and encoding AVL sequence sets (#8646)
  • - Fast batch publish now reports backward sequence gaps as well as forward gaps (#8699)
  • - Stream pending message calculations avoid unnecessary filestore cache access and handle deleted sequence ranges more efficiently (#8680, #8681)
  • - Stream restore waits for the preferred node to become leader, avoiding an incorrect create response during clustered restore (#8690)
  • - Memory backed streams avoid copying message headers and bodies twice when storing messages (#8652, contributed by @randomizedcoder)
  • - Leafz now reports whether a leafnode connection uses WebSockets (#8683)
  • - Partial packets are no longer copied in full on every read, reducing allocations and buffer copying (#8692)
  • - Leafnode clients are now shed alongside regular clients during lame duck shutdown, avoiding a thundering herd (#8695)

additions (3)

  • - TLS state is now available to auth callouts when leafnodes connect over WebSockets (#8686, contributed by @jurry-duty)
  • - Remote proxies now support TLS with https:// proxy URLs and an optional proxy tls block (#8701)
  • - Leafnode interest and request/reply across account imports (#8730, contributed by @edjeffreys)
Add NATS to your stack

A weekly email arrives when a release needs action. Like the breaking changes in this release.

Add to stack →
Official release note ↗All NATS releases →
NATS v2.14.8 — 3 breaking changes