NATS
v2.12.12Networking & Messagingv2.12.12 is a bugfix and hardening release for nats-server, centered on numerous JetStream/Raft data-integrity and panic fixes plus removal of JSONP support from monitoring endpoints. No CVEs are disclosed, but several fixes close memory-exhaustion and panic paths reachable via malformed MQTT input that operators should treat as security-relevant.
breakingJSONP support removed from monitoring endpoints
JSONP callback support has been removed from monitoring endpoints in v2.12.12, unconditionally. Any tooling or dashboards that rely on JSONP callbacks against /varz, /connz, or similar endpoints will break and must switch to plain JSON requests.
securityMQTT partial-CONNECT and PUBLISH-underflow crash/DoS fixes
If you run MQTT, upgrade to fix two memory-exhaustion/panic paths: partial CONNECT packets could exhaust pre-authentication memory, and PUBLISH remaining-length underflow could panic the server. Both are exploitable by unauthenticated clients sending malformed input.
securityInteger-overflow panics fixed in monitoring and JetStream usage tracking
CONNZ/SUBSZ pagination previously could panic on integer overflow, and JetStream remote usage updates could panic on length integer overflow. Operators with large clusters or heavy monitoring polling should upgrade to remove these panic-inducing edge cases.
主な変更 (8)
- JSONP callback support removed from monitoring endpoints (breaking for any tooling still using it)
- MQTT hardening: partial CONNECT no longer exhausts pre-auth memory, PUBLISH remaining-length underflow no longer panics the server, plus fixes for $MQTT.deliver.pubrel subscription abuse, deny-rule enforcement on retained/QoS replay, and a WebSocket /mqtt upgrade panic when MQTT is disabled
- Large batch of JetStream/Raft data-integrity fixes: filestore compaction corruption, counter stream staging corruption, meta recovery phantom streams/consumers, raft checkpoint/ApplyCommit correctness, stream catchup desync, and membership revert on truncate/snapshot
- Panic and integer-overflow fixes in CONNZ/SUBSZ pagination, JetStream remote usage updates, and a nil-pointer panic on startup when the resolver parent directory is missing
- Multiple panic, fatal-error, and data-race fixes across authentication, routing, monitoring, and clustered request handling
- Gateway/proxy fixes: race in gateway CONNECT handling, leak in trusted proxy tracking, PROXY protocol detection, TLS sniffing with allow_non_tls, and PROXY v1 address-family parsing
- Service import replies now deliver across cluster routes, and message tracing works correctly with imports/exports; JWT inherited default permissions and external auth config now refresh correctly on account claim updates
- Plus routine fixes: quieter per-connection logging, consistent writer options under s2_fast compression, and refactored stream/consumer assignment handling for migrations