Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Mar 2026Clear ×Project: NATSClear ×

NATSv2.12.6Networking & MessagingMar 24, 2026

ACTION 1CHECK 13OTHER 36View full analysis

A maintenance release with multiple security fixes, tighter JWT and MQTT-related enforcement, and dependency manifest updates. It also includes correctness fixes and improvements across networking, monitoring, clustering, and JetStream.

Action needed (1)

breakingJWT size limit
JWTs now have a 1MB size limit.

Check if affected (13)

securityhighMQTT security fixes
Applies if you use MQTT.
Fixes CVE-2026-33216, CVE-2026-33217, and CVE-2026-33215 in systems using MQTT.
securityhighLeafnode security fix
Applies if you use leafnodes.
Fixes CVE-2026-33218 in systems using leafnodes.
securityhighCommand-line credential security fix
Applies if you provide credentials on the command line.
Fixes CVE-2026-33247 in systems providing credentials on the command line.
+ 10 more on the release page

Source ↗

NATSv2.11.15Networking & MessagingMar 24, 2026

ACTION 1CHECK 11OTHER 22View full analysis

A maintenance release with multiple disclosed security fixes, correctness fixes, stricter validation and permission constraints, and dependency and toolchain updates. It also includes fixes across MQTT, JetStream, leafnodes, WebSockets, monitoring, and clustering.

Action needed (1)

breakingThe JWT size limit
JWTs now have a 1MB size limit.

Check if affected (11)

securityhighCVE-2026-33216, CVE-2026-33217, and CVE-2026-33215 fixes for MQTT systems
Applies if you use MQTT.
This release fixes CVE-2026-33216, CVE-2026-33217, and CVE-2026-33215 in systems using MQTT.
securityhighCVE-2026-33218 fix for leafnodes
Applies if you use leafnodes.
This release fixes CVE-2026-33218 in systems using leafnodes.
securityhighCVE-2026-33247 fix for command-line credentials
Applies if you configure credentials on the command line.
This release fixes CVE-2026-33247 in systems providing credentials on the command line.
+ 8 more on the release page

Source ↗

Browse by month