{"record":{"id":"81239269be25708b","repo":"nats-io/nats-server","slug":"template-expansion-exceeds-limit","errorCode":null,"errorMessage":"template expansion exceeds limit","messagePattern":"template expansion exceeds limit","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth.go","lineNumber":476,"sourceCode":"\t}\n\ttlsState := c.GetTLSConnectionState()\n\tif tlsState == nil || len(tlsState.PeerCertificates) == 0 || tlsState.PeerCertificates[0] == nil {\n\t\tc.Debugf(\"Failed pinned cert test as client did not provide a certificate\")\n\t\treturn false\n\t}\n\tsha := sha256.Sum256(tlsState.PeerCertificates[0].RawSubjectPublicKeyInfo)\n\tkeyId := hex.EncodeToString(sha[:])\n\tif _, ok := tlsPinnedCerts[keyId]; !ok {\n\t\tc.Debugf(\"Failed pinned cert test for key id: %s\", keyId)\n\t\treturn false\n\t}\n\treturn true\n}\n\nvar (\n\tmustacheRE                             = regexp.MustCompile(`{{2}([^}]+)}{2}`)\n\tmaxPermTemplateSubjectExpansions       = 4096\n\terrPermTemplateExpansionLimit    error = fmt.Errorf(\"template expansion exceeds limit\")\n)\n\nfunc processUserPermissionsTemplate(lim jwt.UserPermissionLimits, ujwt *jwt.UserClaims, acc *Account) (jwt.UserPermissionLimits, error) {\n\tnArrayCartesianProduct := func(a ...[]string) [][]string {\n\t\tc := 1\n\t\tfor _, a := range a {\n\t\t\tc *= len(a)\n\t\t}\n\t\tif c == 0 {\n\t\t\treturn nil\n\t\t}\n\t\tp := make([][]string, c)\n\t\tb := make([]string, c*len(a))\n\t\tn := make([]int, len(a))\n\t\ts := 0\n\t\tfor i := range p {\n\t\t\te := s + len(a)\n\t\t\tpi := b[s:e]","sourceCodeStart":458,"sourceCodeEnd":494,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/auth.go#L458-L494","documentation":"Wrapped sentinel errPermTemplateExpansionLimit: expanding mustache-style {{tag:x}} templates in a permission subject (or subscription/response templates) would produce a cartesian product exceeding maxPermTemplateSubjectExpansions, so the expansion is aborted to bound memory/CPU.","triggerScenarios":"Thrown at server/auth.go:476 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Reduce the number of distinct template tokens in the permission subject","Narrow the account tags so fewer values match each {{tag:...}} prefix","Split the permission across multiple explicit subjects instead of one heavily templated subject"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}