What causes "'min_version' wrong type: %v" in nats-io/nats-server?

Set min_version to a quoted string like "1.2" or "1.3"

'min_version' wrong type: %v

Error message

'min_version' wrong type: %v

What it means

parseTLSVersion accepts either a string version name (via tlsVersionFromString) or a numeric TLS version, and returns this error in its default case when the 'min_version' value is neither of those types. It is a type validation error: the YAML/JSON config value has an unexpected Go type.

Source

Thrown at server/opts.go:5116

func parseCurvePreferences(curveName string) (tls.CurveID, error) {
	curve, exists := curvePreferenceMap[curveName]
	if !exists {
		return 0, fmt.Errorf("unrecognized curve preference %s", curveName)
	}
	return curve, nil
}

func parseTLSVersion(v any) (uint16, error) {
	var tlsVersionNumber uint16
	switch v := v.(type) {
	case string:
		n, err := tlsVersionFromString(v)
		if err != nil {
			return 0, err
		}
		tlsVersionNumber = n
	default:
		return 0, fmt.Errorf("'min_version' wrong type: %v", v)
	}
	if tlsVersionNumber < tls.VersionTLS12 {
		return 0, fmt.Errorf("unsupported TLS version: %s", tls.VersionName(tlsVersionNumber))
	}
	return tlsVersionNumber, nil
}

// Helper function to parse TLS configs.
func parseTLS(v any, isClientCtx bool) (t *TLSConfigOpts, retErr error) {
	var (
		tlsm map[string]any
		tc   = TLSConfigOpts{}
		lt   token
		ics  []*tls.CipherSuite // Insecure ciphers found
	)
	defer convertPanicToError(&lt, &retErr)

	tk, v := unwrapValue(v, &lt)

View on GitHub (pinned to 3a66a489d2)

Solutions

Set min_version to a quoted string like "1.2" or "1.3"
Or use a plain integer TLS version constant value
Verify the parsed YAML/JSON type of the field before passing to parseTLS

Example fix

// before (YAML)
min_version: [1.2]
// after
min_version: "1.2"

Defensive patterns

Strategy: type-guard

Validate before calling

v, ok := cfg["min_version"]
if !ok || !(isString(v) || isNumber(v)) {
  return fmt.Errorf("min_version must be a string or number, got %T", v)
}

Type guard

func isTLSType(v interface{}) bool {
  switch v.(type) { case string, int, float64: return true }
  return false
}

Try / catch

if _, err := parseTLSVersion(raw); err != nil { log.Fatalf("bad min_version: %v", err) }

Prevention

Quote TLS version strings in YAML ("1.2")
Assert config types against a JSON schema before load
Avoid building tls maps with dynamic values

When it happens

Trigger: Setting min_version (or related version fields) in TLS config to a non-string, non-numeric YAML/JSON value such as a bool, list, or map, e.g. 'min_version: true'.

Common situations: YAML config where a version string was unquoted and parsed as something unexpected; copy-paste errors nesting wrong values under tls block.

Related errors

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/e523748804d7dc8b. Report an issue: GitHub.