CVE-2025-59947: NanoMQ has Buffer Overflow

Severity: critical (CVSS 9.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-15 · updated 2026-10-14
Weakness: CWE-120

Description

NanoMQ is a messaging broker/bus for IoT Edge & SDV. Versions prior to 0.24.4 have a buffer overflow case while the PUBLISH packets trigger both shared subscription and vanila subscription. This is fixed in version 0.24.4. As a workaround, disable shared subscription.

Affected products

nanomq: before 0.24.4 — fixed in 0.24.4

How to fix

Upgrade to a fixed version: nanomq 0.24.4. Check the vendor advisory for mitigations.

References

https://github.com/nanomq/nanomq/commit/5f5581054bb92f102cf99251e8af2f43763d457b
https://github.com/nanomq/nanomq/issues/2110
https://github.com/nanomq/nanomq/security/advisories/GHSA-98f4-cmg8-x7f3

Get alerted when CVE-2025-59947 or the next vulnerability affects your stack