Releases

Check if affected (4)

• securityJWT validation with whitespace-only permissions

  Applies if you use JWT validation.

  JWT validation no longer crashes the server when permissions contain only whitespace.

• securityverify_and_map authentication with blank passwords

  Applies if TLS verify_and_map is configured.

  TLS verify_and_map no longer authenticates users with blank passwords, removing the authentication bypass.

• securityMQTT subscription restriction for $MQTT.> subjects

  Applies if you use MQTT.

  MQTT clients can no longer subscribe to $MQTT.> subjects, closing a potential permission bypass.

• + 1 more on the release page

Check if affected (3)

• securityNats-Trace-Dest publish permission checks for leaf connections

  Applies if you use Leaf connections.

  Leaf connections now undergo the same publish permission checks for Nats-Trace-Dest as other connections.

• securityMQTT subscribe deny rules on retained message and QoS replay paths

  Applies if you use MQTT.

  Subscribe deny rules are now enforced when replaying retained messages and QoS messages in MQTT.

• breakingThe JSONP callback support in monitoring endpoints, removed

  Applies if you use JSONP callback support.

  JSONP callback support has been removed from monitoring endpoints in this release.

Check if affected (1)

• breakingThe JSONP callback support in monitoring endpoints, removed

  Applies if you use JSONP callback support.

  JSONP callback support has been removed from monitoring endpoints in this release.

Check if affected (3)

• breakingInsecure TLS cipher suite default

  Applies if you enable allow_insecure_cipher_suites.

  The server now adds new cipher suites automatically and disables insecure cipher suites by default. Insecure suites can be allowed by enabling allow_insecure_cipher_suites.

• breakingJetStream strict mode default

  Applies if you use JetStream.

  The server now returns an error for invalid JetStream requests instead of only logging them, because strict mode is enabled by default. Invalid requests are rejected by the server.

• breakingDowngrade compatibility for new v2.12 features

  Applies if you use new v2.12 features.

  Downgrades are supported only to v2.11.9 or higher. The server recognizes new v2.12 features and places streams or consumers that use them into unsupported or offline mode, protecting the data and server from unsupported features or data.

Check if affected (1)

• breakingThe retained-message subject constraint

  Applies if you use retained messages.

  Retained-message subjects can no longer contain the ASCII DEL character (0x7F). This constraint ships in v2.14.0.

Check if affected (3)

• securityQueue subscription enforcement of ACL deny patterns

  Applies if you use queue subscriptions and configure non-queue ACL deny patterns.

  Queue subscriptions can no longer incorrectly bypass non-queue ACL deny patterns.

• breakingThe no_auth_user configuration field, restricted to client connections

  Applies if you configure no_auth_user.

  no_auth_user is now restricted to client connections only.

• breakingDuplicate INFO permission updates for solicited leaf connections

  Applies if you use solicited leaf connections.

  Duplicate INFO permission updates are now accepted only for solicited leaf connections.

Check if affected (2)

• breakingThe no_auth_user connection scope restriction

  Applies if you configure no_auth_user.

  no_auth_user is restricted to client connections only.

• breakingThe INFO permission update restriction

  Applies if you use solicited leaf connections.

  Duplicate INFO permission updates are accepted only for solicited leaf connections.

Action needed (1)

• breakingJWT size limit

  JWTs now have a 1MB size limit.

Action needed (1)

• breakingThe JWT size limit

  JWTs now have a 1MB size limit.

Check if affected (3)

• securityCVE-2026-29785 fix for leafnode compression

  Applies if leafnode compression is enabled.

  Fixes CVE-2026-29785 in systems with leafnode compression enabled.

• securityCVE-2026-27889 fix for WebSockets

  Applies if WebSockets are enabled.

  Fixes CVE-2026-27889 in systems with WebSockets enabled.

• breakingThe max_conns server configuration value

  Applies if you configure max_conns in the server configuration.

  The server configuration now accepts 0 for max_conns, which rejects all incoming client connections.