Executive brief
NanoMQ, an ultra-lightweight MQTT broker for IoT and edge computing, contains a flaw in how it processes subscription requests. An attacker can send a specially crafted, malformed message that bypasses security checks, potentially allowing unauthorized message subscriptions or causing the service to crash. This could lead to data being sent to unintended recipients or a disruption of communication between IoT devices.
Technical details
A vulnerability exists in nmq_subinfo_decode() within nng/src/sp/protocol/mqtt/mqtt_parser.c due to an off-by-one boundary check. When an MQTT v5 SUBSCRIBE packet is missing the 1-byte 'Subscription Options' field, the parser uses a 'bpos > remain' check that allows a read to occur when 'bpos == remain'. This results in a 1-byte out-of-bounds read. Depending on the heap layout and message size (specifically when the message body is exactly 1024 bytes, triggering an exact allocation in nni_msg_alloc), this can manifest as a heap-buffer-overflow or as a semantic flaw where malformed subscriptions are incorrectly accepted and installed into the broker's internal state.
Affected products
- nanomq NanoMQ <= 0.24.14
Timeline
- 2026-06-23: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: NVD publication date