nats-io/nats-server · error

websocket: cannot be used in FIPS-140 mode when built with t

Error message

websocket: cannot be used in FIPS-140 mode when built with this Go version, use Go 1.26 or later

What it means

Returned by validateWebsocketOptions() at server startup when FIPS-140 mode is enabled but the Go toolchain version predates 1.26, so the crypto primitives required for websocket handshakes are not FIPS-permitted. Configuration is rejected before the server starts; this is a build/toolchain constraint, not a runtime failure.

Source

Thrown at server/websocket.go:1130

}

func wsMakeChallengeKey() (string, error) {
	p := make([]byte, 16)
	if _, err := io.ReadFull(crand.Reader, p); err != nil {
		return _EMPTY_, err
	}
	return base64.StdEncoding.EncodeToString(p), nil
}

// Validate the websocket related options.
func validateWebsocketOptions(o *Options) error {
	wo := &o.Websocket
	// If no port is defined, we don't care about other options
	if wo.Port == 0 {
		return nil
	}
	if !wsAllowedFIPS() {
		return fmt.Errorf("websocket: cannot be used in FIPS-140 mode when built with this Go version, use Go 1.26 or later")
	}
	// Enforce TLS... unless NoTLS is set to true.
	if wo.TLSConfig == nil && !wo.NoTLS {
		return errors.New("websocket requires TLS configuration")
	}
	// Make sure that allowed origins, if specified, can be parsed.
	for _, ao := range wo.AllowedOrigins {
		u, err := url.ParseRequestURI(ao)
		if err != nil {
			return fmt.Errorf("unable to parse allowed origin: %v", err)
		}
		if u.Scheme != "http" && u.Scheme != "https" {
			return fmt.Errorf("unable to parse allowed origin %q: allowed origins must be absolute URLs with http or https scheme", ao)
		}
		if u.Host == _EMPTY_ {
			return fmt.Errorf("unable to parse allowed origin %q: host is required", ao)
		}
		if _, _, err := wsGetHostAndPort(u.Scheme == "https", u.Host); err != nil {

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Rebuild (or upgrade to) a Go 1.26+ binary if websocket support is needed in FIPS-140 mode
2. Disable FIPS-140 mode if acceptable for the deployment
3. Disable the websocket gateway options if websockets are not required

When it happens

Trigger: Thrown at server/websocket.go:1130 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/aa5c5125de6b1660. Report an issue: GitHub.