nats-io/nats-server · error

unable to flush session: %v

Error message

unable to flush session: %v

What it means

After obtaining the PCR/password policy session, tpm2.FlushContext could not release the session handle in the TPM. The session lingers inside the TPM and consumes a session slot; repeated failures could exhaust the TPM's session resources. The key sealing is aborted to avoid proceeding with stale TPM state.

Source

Thrown at server/tpm/js_ek_tpm_windows.go:153

sessHandle, policy, err := policyPCRPasswordSession(rwc, pcr)
if err != nil {
	return "", fmt.Errorf("unable to get policy: %v", err)
}
if err := tpm2.FlushContext(rwc, sessHandle); err != nil {
	return "", fmt.Errorf("unable to flush session: %v", err)
}
// Seal the data to the parent key and the policy
user, err := nkeys.CreateUser()
if err != nil {
	return "", fmt.Errorf("unable to create seed: %v", err)
}

View on GitHub (pinned to 3a66a489d2)

Solutions

  1. Check the wrapped TPM error for resource exhaustion (too many loaded sessions)
  2. Reboot or reset the TPM to clear leaked sessions if slots are exhausted
  3. Retry key creation after the TPM recovers
  4. Upgrade tpm2 library/TPM firmware if FlushContext consistently fails
Defensive patterns

Strategy: retry

When it happens

Trigger: Thrown at server/tpm/js_ek_tpm_windows.go:153 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/6a641599689c4d98. Report an issue: GitHub.