PT-2026-29116 · Nanomq · Nanomq

Published 2026-03-30 · Updated 2026-03-30 · CVE-2026-25627

NVD

CVSS v3.1

6.5

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.24.8, NanoMQ’s MQTT-over-WebSocket transport can be crashed by sending an MQTT packet with a deliberately large Remaining Length in the fixed header while providing a much shorter actual payload. The code path copies Remaining Length bytes without verifying that the current receive buffer contains that many bytes, resulting in an out-of-bounds read (ASAN reports OOB / crash). This is remotely triggerable over the WebSocket listener. This issue has been patched in version 0.24.8.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-25627

Affected Products

Nanomq

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-25627 · Security Note
• https://github.com/nanomq/NanoNNG/pull/1405 · Note
• https://github.com/nanomq/nanomq/releases/tag/0.24.8 · Note
• https://github.com/nanomq/NanoNNG/commit/e80b30bad6d855593a68d18f2785bfaca6faf09e · Note
• https://github.com/nanomq/nanomq/security/advisories/GHSA-w4rh-v3h2-j29x · Note