CVE-2026-45151: NanoMQ: NULL Pointer Dereference
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In 0.24.8 and earlier, quicstreamrecv can dereference a null substream pointer when a substream is in reopen state. The code finishes the AIO with error but does not return before locking c->mtx.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Until a vendor patch is available, block or restrict access to NanoMQ QUIC endpoints. Implement firewall/ACL rules to limit or deny QUIC (UDP) traffic to NanoMQ instances and expose the broker only to trusted hosts/networks.
- Operational
Monitor NanoMQ instances for crashes or abnormal behavior, collect logs and core dumps for any incidents, and restart impacted services as needed. Preserve diagnostic data for vendor troubleshooting and apply vendor-provided fixes as soon as they are released.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45151?
The severity of CVE-2026-45151 is rated as low with a CVSS score of 2.9.
How do I fix CVE-2026-45151?
To fix CVE-2026-45151, upgrade NanoMQ to version 0.24.9 or later.
What type of vulnerability is CVE-2026-45151?
CVE-2026-45151 is a Null Pointer Dereference vulnerability.
What software is affected by CVE-2026-45151?
The affected software is the NanoMQ MQTT Broker, specifically versions 0.24.8 and earlier.
When was CVE-2026-45151 published?
CVE-2026-45151 was published on May 29, 2026.