CVE-2025-66023mediumCWE-416

CVE-2025-66023: medium-severity vulnerability in nanomq

NanoMQ has Use-After-Free of malformed bridging message

Published · Updated

Follow this CVE+ Monitor nanomq

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.4%
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Versions prior to 0.24.5 have a Heap-Use-After-Free (UAF) vulnerability within the MQTT bridge client component (implemented via the underlying NanoNNG library). The vulnerability is triggered when NanoMQ acts as a bridge connecting to a remote MQTT broker. A malicious remote broker can trigger a crash (Denial of Service) or potential memory corruption by accepting the connection and immediately sending a malformed packet sequence. Version 0.34.5 contains a patch. The patch enforces stricter protocol adherence in the MQTT client SDK embedded in NanoMQ. Specifically, it ensures that CONNACK is always the first packet processed in the line. This prevents the state confusion that led to the Heap-Use-After-Free (UAF) when a malicious server sent a malformed packet sequence immediately after connection establishment. As a workaround, validate the remote broker before bridging.
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Affected products
nanomq · nanomq
Related CVEs — nanomq

In the same product, most dangerous first.

CVE-2026-32135HIGHNanoMQ has Heap Buffer Overflow in URI Parameter ParsingEPSS 0.5%CVE-2026-25627MEDIUMnanomq: OOB Read / Crash (DoS) via Malformed MQTT Remaining Length over WebSocketEPSS 0.5%CVE-2026-44639LOWNanoMQ: O(N²) Denial of Service in MQTT v5 Property ParsingEPSS 0.4%CVE-2026-32696LOWNanoMQ HTTP Auth: Missing username/password can trigger a NULL-pointer strlen() in auth_http.c:set_data(), causing a process crash — SIGSEGV, remotely triggerableEPSS 0.4%CVE-2026-47276MEDIUMNULL Pointer Dereference in REST API properties_parse via Malformed user_propertiesEPSS 0.4%CVE-2026-32134MEDIUMNanoMQ: NULL Pointer Dereference Crash in tcptran_pipe_peer During Session RestoreEPSS 0.4%