Reference¶

Look-up facts for NATS Server and JetStream: release matrix, ports, defaults, server configuration keys, stream and consumer fields, message headers, system subjects, client and tooling versions, security advisories, and a hardening checklist. Values are taken from the v2.15.0 server source and the official release notes unless stated otherwise.

Source of truth

Defaults below were read from server/const.go, server/opts.go, server/filestore.go, server/stream.go, and server/consumer.go at tag v2.15.0 (2026-09-17). Re-check the source or the configuration docs after upgrading.

Release Matrix¶

Dates come from the Go module proxy (proxy.golang.org) tag timestamps and the GitHub release pages. NATS skipped 2.13.

Line	First release	Latest patch (date)	Headline features
2.15	2.15.0 (2026-09-17)	2.15.0 (2026-09-17)	Desired-state metalayer, stream move cancel, evacuate endpoints, metalayer rescue, backup/restore v2, default 1,000 consumers per stream
2.14	2.14.0 (2026-04-30)	2.14.7 (2026-09-15)	Fast batch publish, recurring (cron/interval) schedules, WorkQueue/Interest sourcing with `AckFlowControl`, consumer reset API, feature flags, Raft overrun protection
2.13	skipped	n/a	n/a
2.12	2.12.0 (2025-09-22)	2.12.15 (2026-08-12)	Atomic batch publish, counter CRDT, delayed message scheduling, `prioritized` pull policy, mirror promotion, strict JetStream API by default
2.11	2.11.0 (2025-03-19)	2.11.17 (2026-04-27)	Distributed message tracing, per-message TTL, subject delete markers, pull consumer priority groups, consumer pause, ingest rate limiting
2.10	2.10.0 (2023-09-19)	2.10.29 (2025-05-01)	Auth callout, stream compression, subject transforms, multi-filter consumers, route pooling, `sync_interval`

Support windows are not formally published

NATS does not publish fixed EOL dates. Observed practice (2026): security fixes land on the current and previous minor lines (for example the June 2026 advisories were fixed in 2.14.x and 2.12.x, the March 2026 ones in 2.12.x and 2.11.x). Treat any line two minors behind as unsupported. TBD: whether 2.12 receives patches now that 2.15 is out.

Version-Specific Upgrade Rules¶

Moving to	Rule	Source
2.15	All peers must be on 2.14.0+ before 2.15 runs: `js_raft_delete_range` is on by default and older peers panic on the new Raft entry	`server/feature_flags.go` (v2.15.0)
2.15	`js_ack_fc_v2` is still off by default in 2.15.0 (the 2.14 guide had announced a 2.15 default switch)	`server/feature_flags.go` (v2.15.0)
2.14	Remove `feature_flags` from config before downgrading below 2.14	2.14 upgrade guide
2.12	JetStream API is strict: unknown JSON fields are rejected (`jetstream { strict: false }` to relax temporarily)	2.12 upgrade guide
2.12	Downgrade only to 2.11.9 or later (earlier 2.11 does not recognise 2.12-only assets)	2.12 upgrade guide
2.11	Server, cluster and gateway names containing spaces are rejected at startup	2.11 upgrade guide
2.11	Clean shutdown now exits with code 0 (was 1)	2.11 upgrade guide

Ports¶

Only the client and monitoring ports have compiled-in defaults (server/const.go). The others are conventions used across the docs and Helm chart and must be set explicitly.

Port	Listener	Default?	Config block
4222	Client (NATS protocol)	Yes (`DEFAULT_PORT`)	`port`
8222	HTTP monitoring	Default value when enabled (`DEFAULT_HTTP_PORT`)	`http_port` / `-m`
6222	Cluster routes	Convention	`cluster { port }`
7222	Gateways (supercluster)	Convention, no compiled default	`gateway { port }`
7422	Leaf node connections	Yes (`DEFAULT_LEAFNODE_PORT`)	`leafnodes { port }`
1883	MQTT 3.1.1	Convention, must be set	`mqtt { port }`
443 / 8080	WebSocket	Must be set	`websocket { port }`
7777	prometheus-nats-exporter `/metrics`	Exporter default	exporter `-port`

Server Defaults and Limits¶

Setting	Default	Notes
`max_payload`	1 MB (`MAX_PAYLOAD_SIZE`)	Per-message payload cap. Raising it raises buffer sizes on every connection
`max_pending`	64 MB (`MAX_PENDING_SIZE`)	Server-side outbound bytes buffered per client before it is a slow consumer
`write_deadline`	10 s (`DEFAULT_FLUSH_DEADLINE`)	Also settable per `cluster`, `gateway`, `leafnodes` block
`max_connections`	65,536	`DEFAULT_MAX_CONNECTIONS`
`max_control_line`	4,096 bytes	Protocol control line limit
`ping_interval`	2 min	Server-to-client PING
`lame_duck_duration`	2 min	Time over which clients are closed in lame duck mode
`lame_duck_grace_period`	10 s	Wait before starting to close clients
`cluster { pool_size }`	3	Route connections per peer pair (since 2.10)
`cluster { connect_backoff }`	false	Exponential reconnect backoff 1 s to 30 s (since 2.12)
JetStream `sync_interval`	2 min	Filestore fsync interval; `always` fsyncs every write
JetStream `max_buffered_msgs`	10,000	Per-stream ingest queue (since 2.11; unlimited in 2.10)
JetStream `max_buffered_size`	128 MB	Per-stream ingest queue bytes (since 2.11)
JetStream `limits { default_max_consumers }`	1,000	New in 2.15; `-1` disables
Filestore block size	1 / 4 / 8 MB	Chosen from stream limits; 8 MB is the maximum; KV buckets use 4 MB
KV history	1 (max 64)	`nats kv add --history` accepts 1-64
Object Store chunk size	128 KB	Client-side default in `nats.go` (`objDefaultChunkSize`)

Server Configuration Keys¶

Top-Level and Cluster Keys¶

Key	Purpose
`server_name`, `server_tags`, `server_metadata`	Identity and placement. `server_metadata` (map) added in 2.12
`port`, `host`, `http_port`, `https_port`	Client and monitoring listeners
`max_payload`, `max_pending`, `max_connections`, `write_deadline`	Connection limits (see defaults above)
`lame_duck_duration`, `lame_duck_grace_period`	Graceful drain on `--signal ldm`
`tls { cert_file, key_file, ca_file, verify, verify_and_map, cipher_suites, handshake_first }`	TLS for clients; each listener has its own `tls` block
`allow_insecure_cipher_suites`	Re-enable insecure suites, disabled by default since 2.12
`operator`, `system_account`, `resolver`, `resolver_preload`	Decentralized JWT auth
`authorization { ... auth_callout { ... } }`	Static users or auth callout (since 2.10)
`accounts { A { jetstream, users, exports, imports } }`	Static multi-account config
`feature_flags { js_ack_fc_v2: true }`	Opt in or out of staged behaviour (since 2.14)
`cluster { name, port, routes, pool_size, compression, no_advertise, connect_backoff, write_deadline }`	Cluster routes
`gateway { name, port, gateways: [{name, urls}], connect_backoff }`	Supercluster links
`leafnodes { port, remotes: [{url, account, credentials, disabled}], isolate_leafnode_interest, compression }`	Leaf nodes; remotes reloadable since 2.14
`mqtt { port, ... }`, `websocket { port, no_tls, ... }`	Protocol bridges

JetStream Block Keys¶

Keys parsed by parseJetStream in server/opts.go (v2.15.0):

Key	Purpose
`store_dir`	File store directory
`max_memory_store` (`max_mem`) / `max_file_store` (`max_file`)	Per-server resource ceilings
`domain`	JetStream domain, isolates JetStream across leaf nodes
`sync_interval`	Fsync interval or `always`
`cipher` (`chachapoly` or `aes`), `key`, `prev_key`	At-rest encryption, per server
`tpm { ... }`	Windows TPM-backed encryption keys (since 2.11)
`unique_tag`	Spread replicas across a tag, for example availability zones
`max_buffered_size`, `max_buffered_msgs`	Ingest rate limiting (since 2.11)
`strict`	Strict JetStream API JSON parsing (default on since 2.12)
`max_outstanding_catchup`, `request_queue_limit`, `info_queue_limit`, `max_concurrent_io`	Cluster catchup and API queue tuning
`meta_compact`, `meta_compact_size`, `meta_compact_sync`	Meta-layer snapshot tuning
`limits { max_ack_pending, max_ha_assets, max_request_batch, default_max_consumers, duplicate_window, batch }`	Server-wide JetStream limits

JetStream Stream Configuration¶

Fields of StreamConfig (JSON names as used by the API and nats stream add --config):

Field	Meaning	Since
`name`, `subjects`, `description`, `metadata`	Identity and bound subjects	`metadata` 2.10
`retention`	`limits` (default), `interest`, `workqueue`	pre-2.10
`max_msgs`, `max_bytes`, `max_age`, `max_msgs_per_subject`, `max_msg_size`, `max_consumers`	Limits	pre-2.10
`discard`	`old` (default) or `new`; `discard_new_per_subject` for KV-style semantics	pre-2.10
`storage`	`file` or `memory`	pre-2.10
`num_replicas`	1 to 5	pre-2.10
`duplicate_window`	Dedup window for `Nats-Msg-Id` (default 2 min)	pre-2.10
`placement`, `mirror`, `sources`	Placement and replication topology	pre-2.10
`compression`	`none` or `s2` for file streams	2.10
`first_seq`, `subject_transform`, `republish`	Sequence seed, transforms, republish	2.10
`allow_direct`, `mirror_direct`	Direct get (used by KV)	pre-2.10
`sealed`, `deny_delete`, `deny_purge`, `allow_rollup_hdrs`	Immutability and rollup controls	pre-2.10
`consumer_limits`	Default `inactive_threshold` and `max_ack_pending` for consumers	2.10
`allow_msg_ttl`, `subject_delete_marker_ttl`	Per-message TTL and delete markers	2.11
`allow_msg_counter`	Counter CRDT stream	2.12
`allow_atomic`	Atomic batch publish	2.12
`allow_msg_schedules`	Delayed (2.12) and recurring (2.14) schedules	2.12 / 2.14
`persist_mode`	`default` (flush immediately) or `async`	present in 2.15 source
`allow_batched`	Fast batch publish	2.14

JetStream Consumer Configuration¶

Field	Values / meaning
`durable_name`, `name`, `description`, `metadata`	Identity
`deliver_policy`	`all`, `last`, `new`, `by_start_sequence`, `by_start_time`, `last_per_subject`
`ack_policy`	`none`, `all`, `explicit`, `flow_control` (2.14, used for WorkQueue/Interest sourcing)
`ack_wait`, `max_deliver`, `backoff`, `max_ack_pending`	Redelivery control
`filter_subject`, `filter_subjects`	Server-side filtering; multiple filters since 2.10
`replay_policy`	`instant` or `original`
`max_waiting`, `max_batch`, `max_expires`, `max_bytes`	Pull request limits
`deliver_subject`, `deliver_group`, `flow_control`, `idle_heartbeat`	Push consumers
`inactive_threshold`	Cleanup of idle consumers
`num_replicas`, `mem_storage`	Consumer state replication and storage
`headers_only`, `sample_freq`, `rate_limit_bps`	Delivery shaping and sampling
`pause_until`	Consumer pause (2.11)
`priority_groups`, `priority_policy`, `priority_timeout`	`none`, `overflow`, `pinned_client` (2.11), `prioritized` (2.12)

Message Headers¶

Header	Purpose	Since
`Nats-Msg-Id`	Publish deduplication within `duplicate_window`	pre-2.10
`Nats-Expected-Stream`, `Nats-Expected-Last-Sequence`, `Nats-Expected-Last-Msg-Id`	Optimistic concurrency on publish	pre-2.10
`Nats-Expected-Last-Subject-Sequence`	Per-subject CAS (used by KV `Update`)	pre-2.10
`Nats-Rollup`	`sub` or `all` rollup purge	pre-2.10
`Nats-TTL`	Per-message TTL (seconds or duration string)	2.11
`Nats-Marker-Reason`	Reason on subject delete markers	2.11
`Nats-Trace-Dest`, `Nats-Trace-Only`	Distributed message tracing	2.11
`Nats-Incr`, `Nats-Counter-Sources`	Counter CRDT increments and aggregation	2.12
`Nats-Batch-Id`, `Nats-Batch-Sequence`, `Nats-Batch-Commit`	Atomic and fast batch publish	2.12 / 2.14
`Nats-Schedule`, `Nats-Schedule-Target`, `Nats-Schedule-TTL`, `Nats-Schedule-Time-Zone`, `Nats-Schedule-Source`	Message scheduling	2.12 / 2.14
`Nats-Schedule-Rollup`	Rollup on scheduled message	2.14
`Nats-Pin-Id`	Pinned-client priority group	2.11

Special Subjects¶

Subject	Purpose
`_INBOX.>`	Default request-reply inbox prefix used by clients
`$JS.API.>`	JetStream management API (`STREAM.CREATE`, `CONSUMER.CREATE`, `META.RESCUE` in 2.15, ...)
`$JS.ACK.>`	Acknowledgements. v1: `$JS.ACK.<stream>.<consumer>...`; v2 adds `<domain>.<account hash>` (flag `js_ack_fc_v2`)
`$JS.FC.>`	Flow control replies (same v1/v2 split)
`$JS.EVENT.ADVISORY.>` / `$JS.EVENT.METRIC.>`	JetStream advisories and metrics
`$KV.<bucket>.<key>`	KV keys, stored in stream `KV_<bucket>`
`$O.<bucket>.C.<nuid>` / `$O.<bucket>.M.<name>`	Object Store chunks and metadata, both in stream `OBJ_<bucket>`
`$SYS.ACCOUNT.<acc>.CONNECT` / `.DISCONNECT`	Connection events (system account)
`$SYS.SERVER.<id>.CLIENT.AUTH.ERR`	Authentication error events
`$SYS.SERVER.<id>.STATSZ`, `$SYS.REQ.SERVER.PING.<endpoint>`	Server statistics and discovery
`$SYS.REQ.SERVER.<id>.RELOAD`	Config reload over NATS (2.10)

Clients and Tooling¶

Versions checked 2026-09-25 against package registries.

Component	Package	Latest (date)
Server	`github.com/nats-io/nats-server/v2`	v2.15.0 (2026-09-17)
`nats` CLI	`github.com/nats-io/natscli`	v0.5.0 (2026-09-17)
`nsc`	`github.com/nats-io/nsc/v2`	v2.15.0 (2026-06-02)
NACK	`github.com/nats-io/nack`, Helm chart `nats/nack` 0.35.0	v0.24.0 (2026-08-18)
Helm chart	`nats/nats`	2.15.0 (image `nats:2.15.0-alpine`)
Go client	`github.com/nats-io/nats.go` (JetStream API in `jetstream` package)	v1.54.0 (2026-09-18)
JavaScript/TypeScript	`@nats-io/transport-node` and sibling `@nats-io/*` modules (nats.js v3)	3.4.0 (2026-05-08)
Python	`nats-py` (PyPI)	2.16.0 (2026-09-16)
Rust	`async-nats` (crates.io)	0.50.0 (2026-07-20)
.NET	`NATS.Net` (NuGet)	3.2.0 (2026-08-29)
Java	`io.nats:jnats` (Maven Central)	2.26.3 (Maven metadata updated 2026-09-10)

Deprecated JavaScript packages

The npm nats package (last 2.29.3, 2025-03) is marked "Package moved. Use @nats-io/transport-node". The modular @nats-io/* v3 packages (repo nats-io/nats.js) supersede the older per-runtime nats, nats.ws and nats.deno packages.

NACK Custom Resources¶

API group jetstream.nats.io/v1beta2.

Kind	Legacy controller (default)	`--control-loop` controller
`Stream`	Yes	Yes
`Consumer`	Yes	Yes
`KeyValue`	No	Yes
`ObjectStore`	No	Yes
`Account` (connection and credentials config, does not create NATS accounts)	No	Yes

Authentication Modes¶

Mode	Use case
No auth	Local development only
Username/password or token	Small static deployments
NKey (Ed25519 challenge)	Services without JWT bookkeeping
TLS client certificate (`verify_and_map`)	PKI as source of identity
Decentralized JWT (operator, account, user)	Production, multi-tenant, superclusters
Auth callout (since 2.10)	Delegate authN/authZ to an external service (LDAP, OIDC, custom)

NKey prefixes: O operator, A account, U user, N server, C cluster, S seed (private key), X curve (xkey encryption).

Security Advisories¶

Selected entries from advisories.nats.io. Always run the latest patch of a supported line.

ID	Published	Summary	Fixed in
Security notes 2026-16 to 2026-28 (13 GHSAs, e.g. `GHSA-38x3-76xf-cq45`)	2026-06-29	Route API auth bypass, subscribe/queue authz bypasses, MQTT ACL and injection issues, pre-auth panics	2026-16: v2.14.0, v2.12.7, v2.11.16; check each note for the others
CVE-2026-33215 to CVE-2026-33249 (11 CVEs)	2026-03-24	MQTT password disclosure and ACL bypass, `Nats-Request-Info` spoofing, stream restore auth bypass, mTLS DN bypass, WebSocket pre-auth DoS	v2.12.6, v2.11.15 (confirmed for 33215 and 33249; check each note)
CVE-2026-27889, CVE-2026-29785	2026-03-09	Pre-auth crash via WebSocket frames and leaf node handshake	v2.12.6, v2.11.15 (27889)
CVE-2025-30215	2025-04-08	JetStream asset management across accounts (critical)	v2.11.1, v2.10.27
CVE-2023-47090	2023-10-12	Auth bypass when only the system account is configured	v2.10.2, v2.9.23
CVE-2022-24450	2022-02-07	Authenticated client could assume unconstrained accounts (critical)	v2.7.2