v2.11.17

nats-io/nats-serverv2.11.17Apr 27, 2026by github-actions[bot]

AI Summary

A maintenance release for the 2.11 branch focusing on general bug fixes, JWT validation, and security improvements regarding monitoring endpoints.

Key Highlights

Fixed JWT claims crossing midnight validation
Securely redacted bearer JWTs in the `/connz` monitoring endpoint
Fixed header mutation bugs that could corrupt buffers
Fixed panic when negotiating compression on leafnode connections

Full Release Notes

## Changelog

Refer to the [2.11 Upgrade Guide](https://docs.nats.io/release-notes/whats_new/whats_new_211) for backwards compatibility notes with 2.10.x.

### Go Version

- 1.25.9

### Dependencies

- github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op
- github.com/klauspost/compress v1.18.5
- github.com/minio/highwayhash v1.0.4
- golang.org/x/crypto v0.50.0
- golang.org/x/sys v0.43.0
- github.com/nats-io/nats.go v1.51.0

### Fixed

General

- Reload logic on gateway `pinned_certs` configuration has been corrected
- Repeated `CONNECT` messages on a connection now clear subscriptions
- JWT claims with validity times that cross midnight are now validated correctly
- The `/connz` monitoring endpoint no longer discloses bearer JWTs
- Monitoring redaction of route and cluster URL secrets when passed in as command line arguments
- Fixed a panic that could occur when negotiating compression on leafnode connections
- Max control line enforcement for non-clients has been fixed
- Fixed a bug where setting message headers could mutate the input message buffers

### Complete Changes
 
https://github.com/nats-io/nats-server/compare/v2.11.16...v2.11.17