nats-io/nats-server · error

pool_size cannot be negative if pinned accounts are specifie

Error message

pool_size cannot be negative if pinned accounts are specified

What it means

validateCluster rejects the configuration when cluster.pinned_accounts is non-empty and cluster.pool_size is negative: pinned accounts require a known pool size so the server can pre-allocate internal structures per account, so a negative (unset/computed) pool size is invalid in that combination.

Source

Thrown at server/server.go:1142

	// Check that cluster name if defined matches any gateway name.
	// Note that we have already verified that the gateway name does not have spaces.
	if o.Gateway.Name != _EMPTY_ && o.Gateway.Name != o.Cluster.Name {
		if o.Cluster.Name != _EMPTY_ {
			return ErrClusterNameConfigConflict
		}
		// Set this here so we do not consider it dynamic.
		o.Cluster.Name = o.Gateway.Name
	}
	clusterName := o.Cluster.Name
	if clusterName == _EMPTY_ && len(o.LeafNode.Remotes) > 0 && o.Cluster.Port == 0 {
		clusterName = o.ServerName
	}
	if clusterName == leafNoOriginCluster {
		return ErrClusterNameReserved
	}
	if l := len(o.Cluster.PinnedAccounts); l > 0 {
		if o.Cluster.PoolSize < 0 {
			return fmt.Errorf("pool_size cannot be negative if pinned accounts are specified")
		}
		m := make(map[string]struct{}, l)
		for _, a := range o.Cluster.PinnedAccounts {
			if _, exists := m[a]; exists {
				return fmt.Errorf("found duplicate account name %q in pinned accounts list %q", a, o.Cluster.PinnedAccounts)
			}
			m[a] = struct{}{}
		}
	}
	return nil
}

func validatePinnedCerts(pinned PinnedCertSet) error {
	re := regexp.MustCompile("^[a-f0-9]{64}$")
	for certId := range pinned {
		entry := strings.ToLower(certId)
		if !re.MatchString(entry) {
			return fmt.Errorf("error parsing 'pinned_certs' key %s does not look like lower case hex-encoded sha256 of DER encoded SubjectPublicKeyInfo", entry)

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Set cluster.pool_size to a non-negative value (e.g. the number of expected accounts)
2. Remove cluster.pinned_accounts if pooling is not needed
3. Use an explicit pool_size instead of relying on auto-sizing

When it happens

Trigger: Thrown at server/server.go:1142 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/b05f12bb4d941648. Report an issue: GitHub.