{"record":{"id":"e7a7bdf1c03fa066","repo":"nats-io/nats-server","slug":"invalid-deny-imports-for-remote-s-w","errorCode":null,"errorMessage":"invalid deny_imports for remote %s: %w","messagePattern":"invalid deny_imports for remote (.+?): %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/leafnode.go","lineNumber":220,"sourceCode":"\t}\n}\n\n// Ensure that leafnode is properly configured.\nfunc validateLeafNode(o *Options) error {\n\tif err := validateLeafNodeAuthOptions(o); err != nil {\n\t\treturn err\n\t}\n\n\tif len(o.LeafNode.Remotes) > 0 {\n\t\tnames := make(map[string]struct{})\n\t\t// Check for duplicate remotes, also, users can bind to any local account,\n\t\t// if its empty we will assume the $G account.\n\t\tfor _, r := range o.LeafNode.Remotes {\n\t\t\tif r.LocalAccount == _EMPTY_ {\n\t\t\t\tr.LocalAccount = globalAccountName\n\t\t\t}\n\t\t\tif err := checkPermSubjectArray(r.DenyImports, false); err != nil {\n\t\t\t\treturn fmt.Errorf(\"invalid deny_imports for remote %s: %w\", r.safeName(), err)\n\t\t\t}\n\t\t\tif err := checkPermSubjectArray(r.DenyExports, false); err != nil {\n\t\t\t\treturn fmt.Errorf(\"invalid deny_exports for remote %s: %w\", r.safeName(), err)\n\t\t\t}\n\t\t\trn := r.name()\n\t\t\tif _, dup := names[rn]; dup {\n\t\t\t\treturn fmt.Errorf(\"duplicate remote %s\", r.safeName())\n\t\t\t}\n\t\t\tnames[rn] = struct{}{}\n\t\t}\n\t}\n\n\t// In local config mode, check that leafnode configuration refers to accounts that exist.\n\tif len(o.TrustedOperators) == 0 {\n\t\taccNames := map[string]struct{}{}\n\t\tfor _, a := range o.Accounts {\n\t\t\taccNames[a.Name] = struct{}{}\n\t\t}","sourceCodeStart":202,"sourceCodeEnd":238,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/leafnode.go#L202-L238","documentation":"Leafnode configuration validation: checkPermSubjectArray rejected a subject in the deny_imports list of a leafnode remote, wrapped with the remote's name.","triggerScenarios":"Thrown at server/leafnode.go:220 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Fix invalid subject syntax in deny_imports","Remove empty or malformed entries","Follow NATS subject wildcard rules in deny lists"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}