Releases

Check if affected (4)

• securityJWT validation with whitespace-only permissions

  Applies if you use JWT validation.

  JWT validation no longer crashes the server when permissions contain only whitespace.

• securityverify_and_map authentication with blank passwords

  Applies if TLS verify_and_map is configured.

  TLS verify_and_map no longer authenticates users with blank passwords, removing the authentication bypass.

• securityMQTT subscription restriction for $MQTT.> subjects

  Applies if you use MQTT.

  MQTT clients can no longer subscribe to $MQTT.> subjects, closing a potential permission bypass.

• + 1 more on the release page

Action needed (1)

• breakingThe disk concurrency semaphore, increased to 4096 slots

  The disk concurrency semaphore is now set to 4096 slots, up from the previous CPU-scaled count. This performance change ships in v2.12.14.

Check if affected (3)

• securityNats-Trace-Dest publish permission checks for leaf connections

  Applies if you use Leaf connections.

  Leaf connections now undergo the same publish permission checks for Nats-Trace-Dest as other connections.

• securityMQTT subscribe deny rules on retained message and QoS replay paths

  Applies if you use MQTT.

  Subscribe deny rules are now enforced when replaying retained messages and QoS messages in MQTT.

• breakingThe JSONP callback support in monitoring endpoints, removed

  Applies if you use JSONP callback support.

  JSONP callback support has been removed from monitoring endpoints in this release.

Action needed (1)

• securityBearer JWT disclosure fix in /connz

  The /connz monitoring endpoint no longer discloses bearer JWTs. The fix ships in the NATS monitoring endpoint.

Check if affected (2)

• securityThe /connz endpoint no longer discloses bearer JWTs

  Applies if you use the /connz monitoring endpoint.

  The /connz monitoring endpoint no longer discloses bearer JWTs.

• securityMonitoring redaction of route and cluster URL secrets

  Applies if you pass route and cluster URL secrets as command line arguments.

  Monitoring now redacts route and cluster URL secrets passed as command line arguments.

Check if affected (3)

• securityQueue subscription enforcement of ACL deny patterns

  Applies if you use queue subscriptions and configure non-queue ACL deny patterns.

  Queue subscriptions can no longer incorrectly bypass non-queue ACL deny patterns.

• breakingThe no_auth_user configuration field, restricted to client connections

  Applies if you configure no_auth_user.

  no_auth_user is now restricted to client connections only.

• breakingDuplicate INFO permission updates for solicited leaf connections

  Applies if you use solicited leaf connections.

  Duplicate INFO permission updates are now accepted only for solicited leaf connections.

Action needed (1)

• breakingJWT size limit

  JWTs now have a 1MB size limit.

Action needed (1)

• breakingThe JWT size limit

  JWTs now have a 1MB size limit.

Check if affected (3)

• securityCVE-2026-29785 fix for leafnode compression

  Applies if leafnode compression is enabled.

  Fixes CVE-2026-29785 in systems with leafnode compression enabled.

• securityCVE-2026-27889 fix for WebSockets

  Applies if WebSockets are enabled.

  Fixes CVE-2026-27889 in systems with WebSockets enabled.

• breakingThe max_conns server configuration value

  Applies if you configure max_conns in the server configuration.

  The server configuration now accepts 0 for max_conns, which rejects all incoming client connections.

Check if affected (2)

• securityhighCVE-2026-29785 fix for leafnode compression

  Applies if CVE-2026-29785 is present and leafnode compression is enabled.

  The release fixes CVE-2026-29785 in systems with leafnode compression enabled.

• securityhighCVE-2026-27889 fix for WebSockets

  Applies if CVE-2026-27889 is present and WebSockets is enabled.

  The release fixes CVE-2026-27889 in systems with WebSockets enabled.