v2.11.14

nats-io/nats-serverv2.11.14Mar 9, 2026by github-actions[bot]

AI Summary

This release updates the Go version to 1.25.8 and addresses two critical security vulnerabilities affecting leafnode compression and WebSockets. It also includes various stability improvements and bug fixes for WebSocket handling and Leafnode compression negotiation.

Key Highlights

Security Fixes: Resolves CVE-2026-29785 (leafnode compression) and CVE-2026-27889 (WebSockets).
Go Version: Upgraded to 1.25.8.
WebSocket Fixes: Corrects invalid parsing of 64-bit payload lengths and improves connection upgrade handling.
Leafnode Fixes: Prevents server panics during subscription negotiation with compression.

Full Release Notes

## Changelog

Refer to the [2.11 Upgrade Guide](https://docs.nats.io/release-notes/whats_new/whats_new_211) for backwards compatibility notes with 2.10.x.

### Go Version

- 1.25.8

### Dependencies

- golang.org/x/crypto v0.48.0 (#7874)
- golang.org/x/sys v0.42.0 (#7923)
- golang.org/x/time v0.15.0 (#7923)

### CVEs

- Fixes CVE-2026-29785 (affects systems with leafnode compression enabled)
- Fixes CVE-2026-27889 (affects systems with WebSockets enabled)

### Fixed

Leafnodes

- Receiving a leafnode subscription before negotiating compression should no longer result in a server panic

WebSockets

- Fix invalid parsing of 64-bit payload lengths, which could lead to a server panic
- Correctly reject compressed frames when compression was not negotiated as a part of the handshake
- The `Origin` header validation now validates the protocol scheme as well as host and port 
- Gracefully handle failed connection upgrades
- The `CLOSE` frame lengths and status codes are now validated correctly
- The compressor state is correctly reset when a max payload error occurs
- Empty compressed buffers should no longer result in a server panic

### Complete Changes
 
https://github.com/nats-io/nats-server/compare/v2.11.12...v2.11.14