Changelog
Refer to the 2.14 Upgrade Guide for backwards compatibility notes with 2.12.x. Please note that the 2.13.x version was skipped.
Go Version
- 1.26.10, which contains mitigations for CVE-2026-111943 by distrusting eMudhra intermediate certificates (#8798)
Dependencies
- github.com/klauspost/compress v1.20.3 (#8798)
- golang.org/x/crypto v0.58.0 (#8798)
- golang.org/x/sys v0.49.0 (#8798)
Fixed
General
- Allowed connection types are now correctly respected in auth callout setups
- Fixed a potential queue sub weight amplification in the sublist
- OCSP responses are now correctly bound to the certificate serial number
JetStream
- Restored v1 stream snapshots now correctly guard against excessive subject lengths, subject counts or block counts
Leafnodes
- ACLs on leafnode connections no longer override allow/deny lists to implicitly allow
$MQTT.>permissions
MQTT
- OCSP verification for MQTT connections now correctly obeys the
ocsp_peeroption in themqttblock