{"record":{"id":"83facd3d42dbb361","repo":"nats-io/nats-server","slug":"invalid-deny-exports-for-remote-s-w","errorCode":null,"errorMessage":"invalid deny_exports for remote %s: %w","messagePattern":"invalid deny_exports for remote (.+?): %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/leafnode.go","lineNumber":223,"sourceCode":"// Ensure that leafnode is properly configured.\nfunc validateLeafNode(o *Options) error {\n\tif err := validateLeafNodeAuthOptions(o); err != nil {\n\t\treturn err\n\t}\n\n\tif len(o.LeafNode.Remotes) > 0 {\n\t\tnames := make(map[string]struct{})\n\t\t// Check for duplicate remotes, also, users can bind to any local account,\n\t\t// if its empty we will assume the $G account.\n\t\tfor _, r := range o.LeafNode.Remotes {\n\t\t\tif r.LocalAccount == _EMPTY_ {\n\t\t\t\tr.LocalAccount = globalAccountName\n\t\t\t}\n\t\t\tif err := checkPermSubjectArray(r.DenyImports, false); err != nil {\n\t\t\t\treturn fmt.Errorf(\"invalid deny_imports for remote %s: %w\", r.safeName(), err)\n\t\t\t}\n\t\t\tif err := checkPermSubjectArray(r.DenyExports, false); err != nil {\n\t\t\t\treturn fmt.Errorf(\"invalid deny_exports for remote %s: %w\", r.safeName(), err)\n\t\t\t}\n\t\t\trn := r.name()\n\t\t\tif _, dup := names[rn]; dup {\n\t\t\t\treturn fmt.Errorf(\"duplicate remote %s\", r.safeName())\n\t\t\t}\n\t\t\tnames[rn] = struct{}{}\n\t\t}\n\t}\n\n\t// In local config mode, check that leafnode configuration refers to accounts that exist.\n\tif len(o.TrustedOperators) == 0 {\n\t\taccNames := map[string]struct{}{}\n\t\tfor _, a := range o.Accounts {\n\t\t\taccNames[a.Name] = struct{}{}\n\t\t}\n\t\t// global account is always created\n\t\taccNames[DEFAULT_GLOBAL_ACCOUNT] = struct{}{}\n\t\t// in the context of leaf nodes, empty account means global account","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/leafnode.go#L205-L241","documentation":"Leafnode configuration validation: checkPermSubjectArray rejected a subject in the deny_exports list of a leafnode remote, wrapped with the remote's name.","triggerScenarios":"Thrown at server/leafnode.go:223 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Fix invalid subject syntax in deny_exports","Remove malformed entries from the list","Validate wildcards/length per NATS subject rules"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}