Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Jul 2026Clear ×Project: NATSClear ×

NATSv2.14.4Networking & MessagingJul 30, 2026

CHECK 4OTHER 37View full analysis

A maintenance release with dependency and toolchain updates, JetStream performance and configuration improvements, and broad correctness fixes. It also includes authentication and permission fixes.

Check if affected (4)

securityJWT validation with whitespace-only permissions
Applies if you use JWT validation.
JWT validation no longer crashes the server when permissions contain only whitespace.
securityverify_and_map authentication with blank passwords
Applies if TLS verify_and_map is configured.
TLS verify_and_map no longer authenticates users with blank passwords, removing the authentication bypass.
securityMQTT subscription restriction for $MQTT.> subjects
Applies if you use MQTT.
MQTT clients can no longer subscribe to $MQTT.> subjects, closing a potential permission bypass.
+ 1 more on the release page

Source ↗

NATSv2.12.14Networking & MessagingJul 30, 2026

ACTION 1CHECK 2OTHER 33View full analysis

A maintenance release with a Go toolchain update, dependency manifest updates, JetStream performance and configuration changes, and numerous correctness fixes. Authentication fixes address security flaws and require upgrading.

Action needed (1)

breakingThe disk concurrency semaphore, increased to 4096 slots
The disk concurrency semaphore is now set to 4096 slots, up from the previous CPU-scaled count. This performance change ships in v2.12.14.

Check if affected (2)

securityAuthentication checks with no_auth_user and auth callouts
Applies if you configure no_auth_user and use auth callouts.
Authentication checks are no longer skipped when no_auth_user is combined with auth callouts and no CONNECT message is sent. This security fix ships in v2.12.14.
securityTLS verify_and_map authentication with blank passwords
Applies if you use TLS and configure verify_and_map.
An authentication bypass involving TLS verify_and_map and users with blank passwords is fixed. This security fix ships in v2.12.14.

Source ↗

Browse by month