Grant-Yim

**Name of the Vulnerable Software and Affected Versions** NanoMQ versions prior to 0.24.14 **Description** A type confusion occurs when `aio->prov data` is stored as `nni quic conn*` during the dialing process but is subsequently read as `ex quic conn*` during the dialer close. This discrepancy leads to invalid object interpretation, resulting in a hang or crash during the close-path execution. **Recommendations** Update to version 0.24.14.

**Name of the Vulnerable Software and Affected Versions** NanoMQ versions prior to 0.24.9 **Description** NanoMQ is an Edge Messaging Platform. A null pointer dereference can occur in the `quic stream recv()` function when a substream is in a reopen state. The system completes the Asynchronous I/O (AIO) operation with an error but fails to return before attempting to lock the `c->mtx` variable. **Recommendations** Update to a version later than 0.24.8.

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.24.10, in NanoMQ's webhook inproc.c, the hook work cb() function processes nng messages by parsing the message body with cJSON Parse(body). The body is obtained from nng msg body(msg), which is a binary buffer without a guaranteed null terminator. This leads to an out-of-bounds read (OOB read) as cJSON Parse reads until it finds a 0, potentially accessing memory beyond the allocated buffer (e.g., nng msg metadata or adjacent heap/stack). The issue is often masked by nng's allocation padding (extra 32 bytes of zeros for non-power-of-two sizes <1024 or non-aligned). The overflow is reliably triggered when the JSON payload length is a power-of-two >=1024 (no padding added). This issue has been patched in version 0.24.10.

**Name of the Vulnerable Software and Affected Versions** NanoMQ versions prior to 0.24.8 **Description** NanoMQ MQTT Broker is an Edge Messaging Platform. Before version 0.24.8, the MQTT-over-WebSocket transport in NanoMQ could be crashed by sending an MQTT packet with a deliberately large Remaining Length in the fixed header while providing a much shorter actual payload. The code copies bytes of the Remaining Length without verifying that the current receive buffer contains that many bytes, resulting in an out-of-bounds read. This can be triggered remotely through the WebSocket listener. **Recommendations** Update NanoMQ to version 0.24.8 or later.