What’s Vulnerable › Products
nanomq vulnerabilities
43 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 28 published in the last 12 months.
Check whether your nanomq version is affected
Latest nanomq vulnerabilities
- CVE-2026-73863 — NanoMQ: Heap-Buffer-Overflow in `nmq_subinfo_decode()` During MQTT v5 SUBSCRIBE Parsing (CVSS 7.0)
- CVE-2026-61633 — NanoMQ: Infinite Loop in UNSUBSCRIBE Decoder Leading to Remote DoS (CVSS 2.0)
- CVE-2026-44639 — NanoMQ: O(N²) Denial of Service in MQTT v5 Property Parsing (CVSS 3.7)
- CVE-2026-47276 — NULL Pointer Dereference in REST API properties_parse via Malformed user_properties (CVSS 6.5)
- CVE-2026-47275 — nanomq NULL Pointer Dereference in MQTTv5 Client CONNECT Decoder Leading to Remote DoS (CVSS 2.6)
- CVE-2026-35217 — NanoMQ Incorrectly Accepts a Malformed SUBSCRIBE and Can Be Driven into an ASAN-Detectable Out-of-Bounds Read (CVSS 6.5)
- CVE-2026-36590 — (CVSS 7.5)
- CVE-2026-45151 — NanoMQ: NULL Pointer Dereference (CVSS 2.9)
- CVE-2026-44640 — NanoMQ: QUIC Dialer Close Type Confusion (CVSS 4.5)
- CVE-2026-32134 — NanoMQ: NULL Pointer Dereference Crash in tcptran_pipe_peer During Session Restore (CVSS 5.9)
- CVE-2026-32135 — NanoMQ has Heap Buffer Overflow in URI Parameter Parsing (CVSS 7.5)
- CVE-2026-34608 — nanomq: Heap-Buffer-Overflow in webhook_inproc.c via cJSON_Parse OOB Read (CVSS 8.2)
- CVE-2026-32696 — NanoMQ HTTP Auth: Missing username/password can trigger a NULL-pointer strlen() in auth_http.c:set_data(), causing a process crash — SIGSEGV, remotely triggerable (CVSS 7.5)
- CVE-2026-25627 — nanomq: OOB Read / Crash (DoS) via Malformed MQTT Remaining Length over WebSocket (CVSS 7.5)
- CVE-2026-21888 — MQTT v5 Variable Byte Integer parsing out-of-bounds: get_var_integer() (CVSS 7.5)
- CVE-2026-22040 — NanoMQ 0.24.6 Use-After-Free Leading to Heap Corruption and Broker Crash (CVSS 5.3)
- CVE-2025-68699 — NanoMQ $share/ Subscription Validation and Forwarding Parsing Inconsistency: NULL Pointer Increment Causes Crash (CVSS 6.5)
- CVE-2024-48077 — (CVSS 7.5)
- CVE-2025-66023 — NanoMQ has Use-After-Free of malformed bridging message (CVSS 4.9)
- CVE-2025-59946 — NanoMQ has a Use After Free vulnerability via sub info list (CVSS 7.5)
- CVE-2025-59947 — NanoMQ has Buffer Overflow (CVSS 9.0)
- CVE-2025-65953 — NanoMQ UAF of retain message due to invalid MQTTV5 properties (CVSS 6.0)
- CVE-2024-42655 — (CVSS 8.8)
- CVE-2024-42651 — (CVSS 7.5)
- CVE-2024-42650 — (CVSS 7.5)