CVE-2024-48077: High severity npm/nanomq vulnerability

Published Jan 15, 2026

Updated

NanoMQ v0.22.7 is vulnerable to Denial of Service (DoS) due to improper resource throttling. A crafted sequence of requests causes the recv-q queue to saturate, leading to the rapid exhaustion of system file descriptors (FDs). This exhaustion triggers a process crash, rendering the broker unable to provide services.

Affected Software

2 affected components

npm/nanomq

emqx Nanomq=0.22.7

Event History

Jan 15, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·08:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-48077?

CVE-2024-48077 is a high-severity vulnerability that allows for a Denial of Service (DoS) due to increased data packets leading to a deadlock.

How do I fix CVE-2024-48077?

To mitigate CVE-2024-48077, upgrade the Nanomq broker to a version beyond 0.22.7 that addresses this vulnerability.

What does CVE-2024-48077 affect?

CVE-2024-48077 affects Nanomq version 0.22.7, specifically in its ability to handle crafted requests.

What are the symptoms of CVE-2024-48077?

Symptoms of CVE-2024-48077 include the Nanomq broker becoming unresponsive and unable to serve requests due to a deadlock.

Is CVE-2024-48077 exploitable remotely?

Yes, CVE-2024-48077 can be exploited remotely by sending crafted requests to the vulnerable Nanomq broker.