Executive brief
NanoMQ is a messaging platform used to connect and manage data from smart devices at the edge of a network. A security flaw in how it handles incoming messages could allow an attacker to crash the service or potentially view sensitive information stored in the system's memory. This could lead to service outages for connected devices or the exposure of internal operational data.
Technical details
An out-of-bounds (OOB) read vulnerability exists in NanoMQ's 'webhook_inproc.c' within the 'hook_work_cb()' function. The vulnerability is caused by passing a binary buffer obtained from 'nng_msg_body()' directly to 'cJSON_Parse()', which expects a null-terminated string. Because the buffer lacks a guaranteed null terminator, the parser may read past the intended memory boundary into adjacent heap or stack data. This is reliably triggered when the JSON payload length is a power-of-two greater than or equal to 1024, as the underlying NNG library does not provide allocation padding in those specific cases. An attacker can exploit this to cause a segmentation fault (DoS) or potentially leak sensitive memory contents. The issue is fixed in version 0.24.10 by ensuring the message length is validated before parsing.
Affected products
- EMQX NanoMQ < 0.24.10
Timeline
- 2026-02-06: patched: Version 0.24.10 released
- 2026-03-31: advisory: GitHub Security Advisory published
- 2026-04-02: disclosed: CVE published to NVD