{"record":{"id":"5d1ffca161a9c4e8","repo":"nats-io/nats-server","slug":"remote-leaf-node-url-q-cannot-be-used-in-fips-140","errorCode":null,"errorMessage":"remote leaf node URL %q cannot be used in FIPS-140 mode when built with this Go version, use Go 1.26 or later","messagePattern":"remote leaf node URL %q cannot be used in FIPS-140 mode when built with this Go version, use Go 1\\.26 or later","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/leafnode.go","lineNumber":316,"sourceCode":"\t\t}\n\n\t\tif len(rcfg.URLs) >= 2 {\n\t\t\tfirstIsWS, ok := isWSURL(rcfg.URLs[0]), true\n\t\t\tfor i := 1; i < len(rcfg.URLs); i++ {\n\t\t\t\tu := rcfg.URLs[i]\n\t\t\t\tif isWS := isWSURL(u); isWS && !firstIsWS || !isWS && firstIsWS {\n\t\t\t\t\tok = false\n\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t}\n\t\t\tif !ok {\n\t\t\t\treturn fmt.Errorf(\"remote leaf node configuration cannot have a mix of websocket and non-websocket urls: %q\", redactURLList(rcfg.URLs))\n\t\t\t}\n\t\t}\n\t\tif !wsAllowedFIPS() {\n\t\t\tfor _, u := range rcfg.URLs {\n\t\t\t\tif isWSURL(u) {\n\t\t\t\t\treturn fmt.Errorf(\"remote leaf node URL %q cannot be used in FIPS-140 mode when built with this Go version, use Go 1.26 or later\", redactURLString(u.String()))\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\t// Validate compression settings\n\t\tif rcfg.Compression.Mode != _EMPTY_ {\n\t\t\tif err := validateAndNormalizeCompressionOption(&rcfg.Compression, CompressionS2Auto); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t}\n\t}\n\n\tif o.LeafNode.Port == 0 {\n\t\treturn nil\n\t}\n\n\t// If MinVersion is defined, check that it is valid.\n\tif mv := o.LeafNode.MinVersion; mv != _EMPTY_ {\n\t\tif err := checkLeafMinVersionConfig(mv); err != nil {","sourceCodeStart":298,"sourceCodeEnd":334,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/leafnode.go#L298-L334","documentation":"When the server is built in FIPS-140 mode with a Go toolchain that lacks post-quantum/ML-KEM TLS support for websocket dialing, remote leaf node URLs using the websocket scheme (ws:// or wss://) are rejected at configuration validation time. The library throws this because FIPS builds before Go 1.26 cannot establish the required TLS connections to websocket leaf node remotes, so accepting them would fail at runtime. This is a startup-time Options validation in validateLeafNode.","triggerScenarios":"Starting a NATS server with FIPS-140 enabled (via fips build flag/mode) where a remote leaf node entry in leafnodes.remotes has a URL with ws:// or wss:// scheme, and the binary was built with a Go version earlier than 1.26 (wsAllowedFIPS() returns false).","commonSituations":"Compliance-driven deployments (government/regulated environments) that compile NATS with FIPS-140 mode and try to connect a leaf node over websockets through a load balancer or CDN that only exposes a WS endpoint; common after upgrading the NATS binary to a FIPS build while keeping the old config.","solutions":["Upgrade the Go toolchain used to build the server to 1.26 or later so FIPS mode supports websocket URLs, then rebuild","Change the remote leaf node URL from ws:// or wss:// to nats:// or tls:// (plain leaf node connection)","Disable FIPS-140 mode if websockets for leaf node remotes are a hard requirement"],"exampleFix":"// before\nleafnodes {\n  remotes = [\n    { url: \"wss://hub.example.com\" }\n  ]\n}\n// after\nleafnodes {\n  remotes = [\n    { url: \"tls://hub.example.com:7443\" }\n  ]\n}","handlingStrategy":"validation","validationCode":"for _, u := range opts.LeafNode.Remotes {\n  for _, url := range u.URLs {\n    if strings.HasPrefix(url, \"ws://\") || strings.HasPrefix(url, \"wss://\") {\n      return fmt.Errorf(\"remote %q uses websocket URL; FIPS mode requires Go 1.26+\", url)\n    }\n  }\n}\nreturn nil","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep separate config files for FIPS and non-FIPS builds","Check runtime/Version and FIPS status at startup before loading leaf remotes","Prefer tls:// leaf URLs unless websockets are required"],"tags":["fips","websocket","leafnode","config-validation"],"backgroundTag":"fips-mode-unsupported-feature","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}