{"record":{"id":"aa5c5125de6b1660","repo":"nats-io/nats-server","slug":"websocket-cannot-be-used-in-fips-140-mode-when-bu","errorCode":null,"errorMessage":"websocket: cannot be used in FIPS-140 mode when built with this Go version, use Go 1.26 or later","messagePattern":"websocket: cannot be used in FIPS-140 mode when built with this Go version, use Go 1\\.26 or later","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/websocket.go","lineNumber":1130,"sourceCode":"}\n\nfunc wsMakeChallengeKey() (string, error) {\n\tp := make([]byte, 16)\n\tif _, err := io.ReadFull(crand.Reader, p); err != nil {\n\t\treturn _EMPTY_, err\n\t}\n\treturn base64.StdEncoding.EncodeToString(p), nil\n}\n\n// Validate the websocket related options.\nfunc validateWebsocketOptions(o *Options) error {\n\two := &o.Websocket\n\t// If no port is defined, we don't care about other options\n\tif wo.Port == 0 {\n\t\treturn nil\n\t}\n\tif !wsAllowedFIPS() {\n\t\treturn fmt.Errorf(\"websocket: cannot be used in FIPS-140 mode when built with this Go version, use Go 1.26 or later\")\n\t}\n\t// Enforce TLS... unless NoTLS is set to true.\n\tif wo.TLSConfig == nil && !wo.NoTLS {\n\t\treturn errors.New(\"websocket requires TLS configuration\")\n\t}\n\t// Make sure that allowed origins, if specified, can be parsed.\n\tfor _, ao := range wo.AllowedOrigins {\n\t\tu, err := url.ParseRequestURI(ao)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"unable to parse allowed origin: %v\", err)\n\t\t}\n\t\tif u.Scheme != \"http\" && u.Scheme != \"https\" {\n\t\t\treturn fmt.Errorf(\"unable to parse allowed origin %q: allowed origins must be absolute URLs with http or https scheme\", ao)\n\t\t}\n\t\tif u.Host == _EMPTY_ {\n\t\t\treturn fmt.Errorf(\"unable to parse allowed origin %q: host is required\", ao)\n\t\t}\n\t\tif _, _, err := wsGetHostAndPort(u.Scheme == \"https\", u.Host); err != nil {","sourceCodeStart":1112,"sourceCodeEnd":1148,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/websocket.go#L1112-L1148","documentation":"Returned by validateWebsocketOptions() at server startup when FIPS-140 mode is enabled but the Go toolchain version predates 1.26, so the crypto primitives required for websocket handshakes are not FIPS-permitted. Configuration is rejected before the server starts; this is a build/toolchain constraint, not a runtime failure.","triggerScenarios":"Thrown at server/websocket.go:1130 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Rebuild (or upgrade to) a Go 1.26+ binary if websocket support is needed in FIPS-140 mode","Disable FIPS-140 mode if acceptable for the deployment","Disable the websocket gateway options if websockets are not required"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}