CVE-2025-59946: NanoMQ has a Use After Free vulnerability via sub info list

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-12-27 · updated 2026-10-13
Weakness: CWE-416

Description

NanoMQ MQTT Broker (NanoMQ) is an Edge Messaging Platform. Prior to version 0.24.2, there is a classical data racing issue about sub info list which could result in heap use after free crash. This issue has been patched in version 0.24.2.

Affected products

nanomq: before 0.24.4 — fixed in 0.24.4

How to fix

Upgrade to a fixed version: nanomq 0.24.4. Check the vendor advisory for mitigations.

References

https://github.com/nanomq/nanomq/issues/1863
https://github.com/nanomq/nanomq/security/advisories/GHSA-xg37-23w7-72p5

Get alerted when CVE-2025-59946 or the next vulnerability affects your stack