CVE-2026-73863: NanoMQ: Heap-Buffer-Overflow in `nmq_subinfo_decode()` During MQTT v5 SUBSCRIBE Parsing

Published Sep 18, 2026
·
Updated

NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's broker-side MQTT v5 nmqsubinfodecode() function in nng/src/sp/protocol/mqtt/mqttparser.c reuses lenofvarint from the outer Properties Length while parsing each SUBSCRIPTIONIDENTIFIER. A remote client can send a SUBSCRIBE packet with a multi-byte Properties Length and repeated subscription identifiers, causing getvarinteger() to begin at an incorrect offset and read beyond the heap message buffer. The flaw is reachable through the broker receive path and can crash the broker, while the separately reported topic-option off-by-one occurs later and is not this vulnerability. This issue is fixed in version 0.24.14.

Affected Software

1 affected component
NanoMQ NanoMQ MQTT broker<0.24.14

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade NanoMQ to a version that resolves this vulnerability.

    Fixed in 0.24.14

Event History

Sep 18, 2026
CVE Published
via MITRE·04:20 PM
Data Sourced
via MITRE·04:20 PM
DescriptionWeakness

Frequently Asked Questions

1

Which deployments are exposed?

NanoMQ broker deployments running versions before 0.24.14 are affected when they accept MQTT v5 SUBSCRIBE packets. The vulnerable code is reachable through the broker receive path.

2

What does an attacker need to send to trigger the issue?

A remote client must send a crafted MQTT v5 SUBSCRIBE packet containing a multi-byte Properties Length and repeated SUBSCRIPTION_IDENTIFIER values. This causes parsing to use an incorrect offset and read beyond the heap message buffer.

3

What is the practical impact of successful exploitation?

The malformed packet can cause an out-of-bounds heap read during parsing and crash the NanoMQ broker.

4

What version fixes the issue?

Upgrade NanoMQ to version 0.24.14, which includes the fix.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203