NATS v2.14.5 updates the Go toolchain and two dependencies, and adds a configurable leafnode dial timeout for high-latency links. It fixes a logger deadlock and a JetStream defect involving idempotent stream creation, with no security advisories or security-specific fixes disclosed.
Releases
AI-analyzed release notes for CNCF graduated and incubating projects.
Project: NATSClear ×
NATS v2.12.15 updates the Go toolchain and dependency manifests. It also fixes deadlocks in logging and a JetStream data-loss bug related to idempotent stream creation when an offline node catches up from a metalayer snapshot.
Source ↗A maintenance release with dependency and toolchain updates, JetStream performance and configuration improvements, and broad correctness fixes. It also includes authentication and permission fixes.
Check if affected (4)
security
JWTvalidation with whitespace-only permissionsApplies if you use JWT validation.
JWT validation no longer crashes the server when permissions contain only whitespace.
security
verify_and_mapauthentication with blank passwordsApplies if TLS
verify_and_mapis configured.TLS
verify_and_mapno longer authenticates users with blank passwords, removing the authentication bypass.securityMQTT subscription restriction for
$MQTT.subjects> Applies if you use
MQTT.MQTT clients can no longer subscribe to
$MQTT.subjects, closing a potential permission bypass.> - + 1 more on the release page
A maintenance release with a Go toolchain update, dependency manifest updates, JetStream performance and configuration changes, and numerous correctness fixes. Authentication fixes address security flaws and require upgrading.
Action needed (1)
breakingThe disk concurrency semaphore, increased to 4096 slots
The disk concurrency semaphore is now set to 4096 slots, up from the previous CPU-scaled count. This performance change ships in v2.12.14.
Check if affected (2)
securityAuthentication checks with
no_auth_userand auth calloutsApplies if you configure
no_auth_userand use auth callouts.Authentication checks are no longer skipped when
no_auth_useris combined with auth callouts and noCONNECTmessage is sent. This security fix ships in v2.12.14.securityTLS
verify_and_mapauthentication with blank passwordsApplies if you use TLS and configure
verify_and_map.An authentication bypass involving TLS
verify_and_mapand users with blank passwords is fixed. This security fix ships in v2.12.14.
A maintenance release with a dependency and toolchain update, broad defect corrections, and behavior improvements across authentication, routing, monitoring, clustering, and JetStream. It also removes JSONP monitoring callbacks and addresses MQTT and authorization-related connection and permission handling.
Check if affected (3)
security
Nats-Trace-Destpublish permission checks for leaf connectionsApplies if you use Leaf connections.
Leaf connections now undergo the same publish permission checks for
Nats-Trace-Destas other connections.security
MQTTsubscribe deny rules on retained message and QoS replay pathsApplies if you use
MQTT.Subscribe deny rules are now enforced when replaying retained messages and QoS messages in
MQTT.breakingThe
JSONPcallback support in monitoring endpoints, removedApplies if you use JSONP callback support.
JSONPcallback support has been removed from monitoring endpoints in this release.
A maintenance release with dependency updates, operational behavior changes, and correctness fixes across General, MQTT, Monitoring, and JetStream. It also removes JSONP callback support from monitoring endpoints.
Check if affected (1)
breakingThe
JSONPcallback support in monitoring endpoints, removedApplies if you use
JSONPcallback support.JSONPcallback support has been removed from monitoring endpoints in this release.
A feature and behavior release for JetStream and server operations, with new capabilities alongside changed defaults and downgrade constraints. Operators using strict JetStream requests, insecure TLS cipher suites, or new v2.12 features should review the changed behavior; the release also fixes a JetStream regression.
Check if affected (3)
breakingInsecure TLS cipher suite default
Applies if you enable
allow_insecure_cipher_suites.The server now adds new cipher suites automatically and disables insecure cipher suites by default. Insecure suites can be allowed by enabling
allow_insecure_cipher_suites.breakingJetStream strict mode default
Applies if you use JetStream.
The server now returns an error for invalid JetStream requests instead of only logging them, because strict mode is enabled by default. Invalid requests are rejected by the server.
breakingDowngrade compatibility for new v2.12 features
Applies if you use new v2.12 features.
Downgrades are supported only to v2.11.9 or higher. The server recognizes new v2.12 features and places streams or consumers that use them into unsupported or offline mode, protecting the data and server from unsupported features or data.
This release adds an API capability and updates the Go toolchain. It also contains correctness and performance fixes across protocol handling, monitoring, clustering, and stream and consumer operations.
Source ↗NATS v2.12.10 combines a new client API capability with correctness fixes across protocol handling, monitoring, clustering, and storage. It also changes stream and consumer constraints and scale-down behavior, removes a filestore check, and updates the Go toolchain.
Source ↗NATS v2.14.1 is a maintenance release with dependency and toolchain updates, monitoring additions, behavioral improvements, and correctness fixes. The release has no security advisories or explicitly described security vulnerabilities.
Source ↗NATS v2.12.9 adds monitoring metrics and broadens acceptance of client TLS certificates with DNS subject alternate names. It also changes several operational behaviors, improves performance, and fixes defects across General, Leafnode, JetStream, Raft, storage, and MQTT functionality. No security advisories or explicitly security-related fixes are disclosed.
Source ↗A feature release adds JetStream, leafnode, configuration, and protocol capabilities alongside fixes. Operator attention is needed for the narrowed MQTT retained-message subject constraint and ACL updates when domain-aware acknowledgements and flow control are enabled; the Go toolchain version also changes.
Check if affected (1)
breakingThe retained-message subject constraint
Applies if you use retained messages.
Retained-message subjects can no longer contain the ASCII DEL character (
0x7F). This constraint ships in v2.14.0.
A maintenance release with a security fix, correctness fixes, a performance improvement, and dependency and toolchain manifest updates. Most changes take effect through the release itself without additional operator action.
Action needed (1)
securityBearer JWT disclosure fix in
/connzThe
/connzmonitoring endpoint no longer discloses bearer JWTs. The fix ships in the NATS monitoring endpoint.
A maintenance release updates the Go toolchain and corrects NATS server defects. It includes fixes for bearer credential disclosure through monitoring and for redaction of route and cluster URL secrets.
Check if affected (2)
securityThe
/connzendpoint no longer discloses bearer JWTsApplies if you use the
/connzmonitoring endpoint.The
/connzmonitoring endpoint no longer discloses bearer JWTs.securityMonitoring redaction of route and cluster URL secrets
Applies if you pass route and cluster URL secrets as command line arguments.
Monitoring now redacts route and cluster URL secrets passed as command line arguments.
A maintenance release with a dependency and toolchain update, configuration constraint changes, performance improvements, and correctness fixes. It also fixes an ACL permission bypass along with issues affecting leaf connections, streams, storage, and client authentication.
Check if affected (3)
securityQueue subscription enforcement of ACL
denypatternsApplies if you use queue subscriptions and configure non-queue ACL
denypatterns.Queue subscriptions can no longer incorrectly bypass non-queue ACL
denypatterns.breakingThe
no_auth_userconfiguration field, restricted to client connectionsApplies if you configure
no_auth_user.no_auth_useris now restricted to client connections only.breakingDuplicate
INFOpermission updates for solicited leaf connectionsApplies if you use solicited leaf connections.
Duplicate
INFOpermission updates are now accepted only for solicited leaf connections.
This release updates the Go toolchain and corrects authorization, leafnode, and WebSocket behavior. Configuration rules for no_auth_user and duplicate leaf permission updates are narrower, so affected existing setups may require review.
Check if affected (2)
breakingThe
no_auth_userconnection scope restrictionApplies if you configure
no_auth_user.no_auth_useris restricted to client connections only.breakingThe
INFOpermission update restrictionApplies if you use solicited leaf connections.
Duplicate
INFOpermission updates are accepted only for solicited leaf connections.
A maintenance release with multiple security fixes, tighter JWT and MQTT-related enforcement, and dependency manifest updates. It also includes correctness fixes and improvements across networking, monitoring, clustering, and JetStream.
Action needed (1)
breakingJWT size limit
JWTs now have a
1MBsize limit.
Check if affected (13)
securityhighMQTT security fixes
Applies if you use
MQTT.Fixes CVE-2026-33216, CVE-2026-33217, and CVE-2026-33215 in systems using
MQTT.securityhighLeafnode security fix
Applies if you use
leafnodes.Fixes CVE-2026-33218 in systems using
leafnodes.securityhighCommand-line credential security fix
Applies if you provide credentials on the command line.
Fixes CVE-2026-33247 in systems providing credentials on the command line.
- + 10 more on the release page
A maintenance release with multiple disclosed security fixes, correctness fixes, stricter validation and permission constraints, and dependency and toolchain updates. It also includes fixes across MQTT, JetStream, leafnodes, WebSockets, monitoring, and clustering.
Action needed (1)
breakingThe
JWTsize limitJWTs now have a 1MB size limit.
Check if affected (11)
securityhighCVE-2026-33216, CVE-2026-33217, and CVE-2026-33215 fixes for MQTT systems
Applies if you use MQTT.
This release fixes CVE-2026-33216, CVE-2026-33217, and CVE-2026-33215 in systems using MQTT.
securityhighCVE-2026-33218 fix for leafnodes
Applies if you use leafnodes.
This release fixes CVE-2026-33218 in systems using leafnodes.
securityhighCVE-2026-33247 fix for command-line credentials
Applies if you configure credentials on the command line.
This release fixes CVE-2026-33247 in systems providing credentials on the command line.
- + 8 more on the release page
A maintenance release with fixes for two CVEs, many correctness issues, expanded JetStream configuration capabilities, and dependency updates. Operators of clustered deployments should review the documented regression affecting stream updates and the changed max_conns behavior.
Check if affected (3)
securityCVE-2026-29785 fix for leafnode compression
Applies if leafnode compression is enabled.
Fixes CVE-2026-29785 in systems with leafnode compression enabled.
securityCVE-2026-27889 fix for
WebSocketsApplies if
WebSocketsare enabled.Fixes CVE-2026-27889 in systems with
WebSocketsenabled.breakingThe
max_connsserver configuration valueApplies if you configure
max_connsin the server configuration.The server configuration now accepts
0formax_conns, which rejects all incoming client connections.
A maintenance release with two security fixes, a Go toolchain version change, and several WebSockets correctness fixes. The WebSockets changes cover compressed frame negotiation, protocol validation, connection upgrades, frame validation, compressor state, and empty compressed buffers.
Check if affected (2)
securityhighCVE-2026-29785 fix for
leafnode compressionApplies if CVE-2026-29785 is present and
leafnode compressionis enabled.The release fixes CVE-2026-29785 in systems with
leafnode compressionenabled.securityhighCVE-2026-27889 fix for
WebSocketsApplies if CVE-2026-27889 is present and
WebSocketsis enabled.The release fixes CVE-2026-27889 in systems with
WebSocketsenabled.
NATS v2.12.4 is a maintenance release focused on correctness across JetStream, configuration, storage, clustering, and consumer behavior. It also updates the Go toolchain and adds TLS certificate expiry information to the varz monitoring endpoint; no security advisories or explicitly described security flaws are included.
NATS v2.11.12 is a maintenance release with WebSocket and monitoring configuration and output additions, along with JetStream and MQTT behavior and performance improvements. It also corrects a broad range of correctness issues; no security advisories or explicitly described security vulnerabilities are identified.
Source ↗