NATS Server 2.15.1 and 2.14.8 Fix JetStream, Leafnode and Account-Permission Bugs and Remove Support for the Legacy $GR. Gateway Reply Prefix

Overview

The NATS maintainers published two maintenance releases of the NATS Server on October 9: v2.15.1 on the 2.15 line and v2.14.8 on the 2.14 line. Both change gateway behavior by removing support for a legacy reply prefix, and both carry a long list of JetStream, leafnode, MQTT and account-permission fixes. The release notes cite no CVE identifiers.

What Changed in Both Releases

Under “Changed,” both release notes say that “Support for sending and handling the legacy $GR. reply prefix, used by servers prior to v2.1.2, has been removed (#8615)” (v2.15.1, v2.14.8). A related fix says the prefix “is now reserved on client ingress, preventing clients from publishing to gateway reply subjects using that prefix (#8615),” according to the v2.15.1 notes.

Several access-control fixes appear in both. According to the v2.14.8 notes, subscription deny filters “are now rebuilt atomically when inherited account permissions are refreshed, preventing a window in which denied messages could be delivered (#8622).” Another entry states that cached subscription results “are now cleared when an already connected client sends another CONNECT, preventing stale results from being reused after an account change (#8641).” The notes also list a fix that makes TLS certificate pin validation check “the correct pins after a configuration reload (#8679)” and a bullet reading “Fixed issues with auth callout auth_users bypass,” with no further detail.

On JetStream, both releases list a fix for “a race during filestore compaction that could cause consumers to skip messages or lose redelivery tracking (#8623)” and removal of stale per-message TTL entries “when their messages have already been deleted, avoiding repeated expiry scans and excess CPU and memory usage (#8595),” per the v2.14.8 notes. Both also add reporting of stalled source and mirror flow control in stream info and warning logs, which the notes say makes “missing $JS.FC.> imports or exports easier to diagnose (#8633).” Both list a Windows fix: “Fixed a PDH counter buffer overflow on Windows.”

What Is Specific to v2.15.1

The v2.15.1 notes say the build uses Go 1.27.2 and that the max_ha_assets limit “is now enforced consistently by the metalayer leader during stream and consumer placement, scaling and moves (#8639).” The 2.15 line introduced that metalayer: the v2.15.0 notes, dated September 17, describe a “desired state metalayer” whose reconciliation engine “considerably improves the safety and reliability of asset moves and scales.”

Several fixes in v2.15.1 address clustered operation, according to its release notes:

• “Consumers are no longer moved to new stream peers before those peers hold the stream data (#8678).”
• “Fixed migration and R1 scale-up issues that could delete a running store or lose writes (#8673).”
• “Clustered snapshots now use the correct generated names for ephemeral consumers, allowing backup validation and restore to succeed (#8651).”
• “Raft nodes will no longer leak their WAL if stopped before route connections are available (#8711).”

The same notes list MQTT throughput work: “QoS2 PUBLISH and PUBREL processing is now pipelined for increased throughput (#8416).”

What Is Specific to v2.14.8

The v2.14.8 notes say the build uses Go 1.26.9, and they carry a reminder that upgrade notes for that line cover moves from 2.12.x: “Please note that the 2.13.x version was skipped.” Fixes listed there but not in v2.15.1 include “Concurrent account JWT updates no longer invalidate stream imports and interrupt message delivery (#8610)” and “Configuration reloads no longer incorrectly disconnect operator mode clients that send an nkey (#8609).” The release also rejects stream scale-down requests “when the target replica count has no configured account tier (#8608).”

Both releases update the nats.go dependency to v1.53.1, per their notes.

What We Don’t Know

The release notes are terse changelog lines and do not describe how many deployments the fixes affect or how the permission-related bugs could be exploited. The maintainers have not, in the notes reviewed, assigned severity ratings or advisory identifiers to the access-control fixes, so operators have to judge urgency from the descriptions themselves. Operators on the 2.15 line are pointed to a 2.15 Upgrade Guide in the v2.15.1 notes for backwards-compatibility information relative to 2.14.x; that guide was not reviewed for this article.

One behavior change from the earlier 2.15.0 release is relevant to anyone upgrading: the v2.15.0 notes state that “Streams now have a default limit of 1000 consumers, unless max_consumers is specified in the stream config or account limits (#8337, #8566).”