v2.11.16

nats-io/nats-serverv2.11.16Apr 14, 2026by github-actions[bot]

AI Summary

A maintenance release for the 2.11 branch mirroring v2.12.7's bug fixes regarding ACLs, `no_auth_user`, and leafnode handling.

Key Highlights

Fixed `no_auth_user` restriction to client connections only
Fixed ACL `deny` pattern enforcement for queue subscriptions
Fixed leafnode ACL permissions and max payload enforcement
Fixed WebSocket fast-path using `no_auth_user` configuration correctly

Full Release Notes

## Changelog

Refer to the [2.11 Upgrade Guide](https://docs.nats.io/release-notes/whats_new/whats_new_211) for backwards compatibility notes with 2.10.x.

### Go Version

- 1.25.9

### CVEs

- TBD

### Fixed

General

- `no_auth_user` is now restricted to client connections only
- Overlapping wildcard patterns in ACL `deny` patterns are now enforced correctly
- Queue subscriptions can no longer incorrectly bypass non-queue ACL `deny` patterns

Leafnodes

- Pre-`CONNECT` guard improvements for leafnode connections, fixing a potential panic
- ACL permissions are now correctly enforced for inbound leaf messages in all cases
- Duplicate `INFO` permissions updates are now only accepted for solicited leaf connections
- The `max_payload` limit is now correctly enforced for leafnode connections

WebSockets

- The fast-path for connections with no `CONNECT` block will now use the WebSocket-specific `no_auth_user` instead of the global one if configured

### Complete Changes
 
https://github.com/nats-io/nats-server/compare/v2.11.15...v2.11.16