nats-io/nats-server · error

invalid deny_imports for remote %s: %w

Error message

invalid deny_imports for remote %s: %w

What it means

Leafnode configuration validation: checkPermSubjectArray rejected a subject in the deny_imports list of a leafnode remote, wrapped with the remote's name.

Source

Thrown at server/leafnode.go:220

	}
}

// Ensure that leafnode is properly configured.
func validateLeafNode(o *Options) error {
	if err := validateLeafNodeAuthOptions(o); err != nil {
		return err
	}

	if len(o.LeafNode.Remotes) > 0 {
		names := make(map[string]struct{})
		// Check for duplicate remotes, also, users can bind to any local account,
		// if its empty we will assume the $G account.
		for _, r := range o.LeafNode.Remotes {
			if r.LocalAccount == _EMPTY_ {
				r.LocalAccount = globalAccountName
			}
			if err := checkPermSubjectArray(r.DenyImports, false); err != nil {
				return fmt.Errorf("invalid deny_imports for remote %s: %w", r.safeName(), err)
			}
			if err := checkPermSubjectArray(r.DenyExports, false); err != nil {
				return fmt.Errorf("invalid deny_exports for remote %s: %w", r.safeName(), err)
			}
			rn := r.name()
			if _, dup := names[rn]; dup {
				return fmt.Errorf("duplicate remote %s", r.safeName())
			}
			names[rn] = struct{}{}
		}
	}

	// In local config mode, check that leafnode configuration refers to accounts that exist.
	if len(o.TrustedOperators) == 0 {
		accNames := map[string]struct{}{}
		for _, a := range o.Accounts {
			accNames[a.Name] = struct{}{}
		}

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Fix invalid subject syntax in deny_imports
2. Remove empty or malformed entries
3. Follow NATS subject wildcard rules in deny lists

When it happens

Trigger: Thrown at server/leafnode.go:220 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/e7a7bdf1c03fa066. Report an issue: GitHub.