RATATOSKRATATOSK
Sign in

NATS

v2.15.2Networking & Messaging
Oct 26, 2026

ACTION 1CHECK 1OTHER 5

A maintenance release with a Go security update and correctness fixes across authentication, certificate handling, JetStream snapshots, leafnode ACLs, and MQTT OCSP behavior. The fixes also address queue subscription weights and connection authentication behavior.

Action needed (1)

  • securityThe Go security update to 1.27.3

    The release updates Go to 1.27.3, which contains mitigations for CVE-2026-111943 by distrusting eMudhra intermediate certificates.

Check if affected (1)

  • securityLeafnode connection ACL enforcement

    Applies if you use leafnode connections.

    ACLs on leafnode connections no longer override allow/deny lists to implicitly allow $MQTT.> permissions.

All 5 other recorded changesfixes 5

fixes (5)

  • - Allowed connection types are now correctly respected in auth callout setups
  • - Fixed a potential queue sub weight amplification in the sublist
  • - OCSP responses are now correctly bound to the certificate serial number
  • - Restored v1 stream snapshots now correctly guard against excessive subject lengths, subject counts or block counts
  • - OCSP verification for MQTT connections now correctly obeys the ocsp_peer option in the mqtt block
Add NATS to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.

Add to stack →
Official release note ↗All NATS releases →