Starstruk Logo MarkStarstruk

v0.68.1

nats-io/nats-serverv0.68.1Apr 13, 2026by fatedier

AI Summary

Addresses a critical security vulnerability by fixing an authentication bypass in HTTP proxy configurations that allowed requests to bypass authentication checks.

Key Highlights

  • Fixed configuration-dependent authentication bypass in `type = "http"` proxies.
  • Affects proxy-style requests using `routeByHTTPUser` with `httpUser`/`httpPassword`.
  • Proxy-style authentication failures now correctly return `407 Proxy Authentication Required`.

Breaking Changes

  • Proxy-style authentication behavior changed: previously bypassed auth now correctly returns 407 Proxy Authentication Required.

Full Release Notes

## Fixes

* Fixed a configuration-dependent authentication bypass in `type = "http"` proxies when `routeByHTTPUser` is used together with `httpUser` / `httpPassword`. This affected proxy-style requests. Proxy-style authentication failures now return `407 Proxy Authentication Required`.