CVE-2026-25627: nanomq: OOB Read / Crash (DoS) via Malformed MQTT Remaining Length over WebSocket

Published Mar 30, 2026
·
Updated

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.24.8, NanoMQ’s MQTT-over-WebSocket transport can be crashed by sending an MQTT packet with a deliberately large Remaining Length in the fixed header while providing a much shorter actual payload. The code path copies Remaining Length bytes without verifying that the current receive buffer contains that many bytes, resulting in an out-of-bounds read (ASAN reports OOB / crash). This is remotely triggerable over the WebSocket listener. This issue has been patched in version 0.24.8.

Affected Software

2 affected components
EMQ NanoMQ<0.24.8
emqx Nanomq<0.24.8

Event History

Mar 30, 2026
CVE Published
via MITRE·08:11 PM
Data Sourced
via MITRE·08:11 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:17 PM
RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2026-25627?

The severity of CVE-2026-25627 is classified as a Denial of Service (DoS) vulnerability.

2

How do I fix CVE-2026-25627?

To mitigate CVE-2026-25627, update NanoMQ to version 0.24.8 or later.

3

What causes the CVE-2026-25627 vulnerability?

CVE-2026-25627 is caused by an out-of-bounds read condition due to a malformed MQTT remaining length in packets sent over WebSockets.

4

Which versions of NanoMQ are affected by CVE-2026-25627?

Versions of NanoMQ prior to 0.24.8 are affected by CVE-2026-25627.

5

What are the potential impacts of CVE-2026-25627?

The potential impacts of CVE-2026-25627 include crashing the NanoMQ broker and resulting service downtime.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203