# NATS v2.15.2

> Networking & Messaging · 2026-10-26

A maintenance release with a Go security update and correctness fixes across authentication, certificate handling, JetStream snapshots, leafnode ACLs, and MQTT OCSP behavior. The fixes also address queue subscription weights and connection authentication behavior.

## Action needed
- **[security]** The `Go` security update to `1.27.3`
  - The release updates `Go` to `1.27.3`, which contains mitigations for `CVE-2026-111943` by distrusting eMudhra intermediate certificates.

## Check if affected
- **[security]** Leafnode connection ACL enforcement
  - Applies if you use leafnode connections.
  - ACLs on leafnode connections no longer override allow/deny lists to implicitly allow `$MQTT.>` permissions.

## Other recorded changes
- 5 (defect_corrected 5)

[Full analysis](https://ratatosk.io/en/releases/nats/v2.15.2)

[Original release notes](https://github.com/nats-io/nats-server/releases/tag/v2.15.2)