RATATOSKRATATOSK
Sign in

NATS

v2.14.9Networking & Messaging
Oct 26, 2026

ACTION 1OTHER 6

A maintenance release with a Go security update and correctness fixes across authentication, OCSP, JetStream, leafnodes, and MQTT behavior. The update matters to deployments that rely on these components or the affected certificate handling.

Action needed (1)

  • securityGo 1.26.10 and CVE-2026-111943 mitigation

    The Go dependency is updated to 1.26.10, which contains mitigations for CVE-2026-111943 by distrusting eMudhra intermediate certificates.

All 6 other recorded changesfixes 6

fixes (6)

  • - Allowed connection types are now correctly respected in auth callout setups
  • - Fixed a potential queue sub weight amplification in the sublist
  • - OCSP responses are now correctly bound to the certificate serial number
  • - Restored v1 stream snapshots now correctly guard against excessive subject lengths, subject counts or block counts
  • - ACLs on leafnode connections no longer override allow/deny lists to implicitly allow $MQTT.> permissions
  • - OCSP verification for MQTT connections now correctly obeys the ocsp_peer option in the mqtt block
Add NATS to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.

Add to stack →
Official release note ↗All NATS releases →