What’s Vulnerable › Vulnerabilities
CVE-2026-22040: NanoMQ 0.24.6 Use-After-Free Leading to Heap Corruption and Broker Crash
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-03-04 · updated 2026-06-17
- Weakness: CWE-416
Description
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In version 0.24.6, by generating a combined traffic pattern of high-frequency publishes and rapid reconnect/kick-out using the same ClientID and massive subscribe/unsubscribe jitter, it is possible to reliably trigger heap memory corruption in the Broker process, causing it to exit immediately with SIGABRT due to free(): invalid pointer. As of time of publication, no known patched versions are available.
Affected products
- nanomq: before 0.24.6 — fixed in 0.24.6
How to fix
Upgrade to a fixed version: nanomq 0.24.6. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-22040 or the next vulnerability affects your stack