nats-io/nats-server · error

invalid deny_exports for remote %s: %w

Error message

invalid deny_exports for remote %s: %w

What it means

Leafnode configuration validation: checkPermSubjectArray rejected a subject in the deny_exports list of a leafnode remote, wrapped with the remote's name.

Source

Thrown at server/leafnode.go:223

// Ensure that leafnode is properly configured.
func validateLeafNode(o *Options) error {
	if err := validateLeafNodeAuthOptions(o); err != nil {
		return err
	}

	if len(o.LeafNode.Remotes) > 0 {
		names := make(map[string]struct{})
		// Check for duplicate remotes, also, users can bind to any local account,
		// if its empty we will assume the $G account.
		for _, r := range o.LeafNode.Remotes {
			if r.LocalAccount == _EMPTY_ {
				r.LocalAccount = globalAccountName
			}
			if err := checkPermSubjectArray(r.DenyImports, false); err != nil {
				return fmt.Errorf("invalid deny_imports for remote %s: %w", r.safeName(), err)
			}
			if err := checkPermSubjectArray(r.DenyExports, false); err != nil {
				return fmt.Errorf("invalid deny_exports for remote %s: %w", r.safeName(), err)
			}
			rn := r.name()
			if _, dup := names[rn]; dup {
				return fmt.Errorf("duplicate remote %s", r.safeName())
			}
			names[rn] = struct{}{}
		}
	}

	// In local config mode, check that leafnode configuration refers to accounts that exist.
	if len(o.TrustedOperators) == 0 {
		accNames := map[string]struct{}{}
		for _, a := range o.Accounts {
			accNames[a.Name] = struct{}{}
		}
		// global account is always created
		accNames[DEFAULT_GLOBAL_ACCOUNT] = struct{}{}
		// in the context of leaf nodes, empty account means global account

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Fix invalid subject syntax in deny_exports
2. Remove malformed entries from the list
3. Validate wildcards/length per NATS subject rules

When it happens

Trigger: Thrown at server/leafnode.go:223 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/83facd3d42dbb361. Report an issue: GitHub.