TI-2025-37334 Aliases CVE-2025-59946

NanoMQ has a Use After Free vulnerability via sub info list

HIGH 68CWE-416Published 2025-12-27 · Updated 2025-12-29

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

NanoMQ MQTT Broker (NanoMQ) is an Edge Messaging Platform. Prior to version 0.24.2, there is a classical data racing issue about sub info list which could result in heap use after free crash. This issue has been patched in version 0.24.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00376 31st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed nanomq (nanomq): 0.24.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
nanomq	nanomq	before 0.24.4	0.24.4	Patch available	CNA

nanomq Vendornanomq Affected before 0.24.4 Fixed in 0.24.4 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:emqx:nanomq::::::::	before 0.24.4	Vulnerable	nanomq

cpe:2.3:a:emqx:nanomq:*:*:*:*:*:*:*:* Versions before 0.24.4 Vulnerable ·nanomq

Remediation

Fix · CNA nanomq (nanomq) Fixed in 0.24.4

Timeline

2026-10-02 Threatist record created from CVE-2025-59946

References

Exploit 1

https://github.com/nanomq/nanomq/issues/1863

Advisory 1

https://github.com/nanomq/nanomq/security/advisories/GHSA-xg37-23w7-72p5

TI-2026-24672 NanoMQ has Heap Buffer Overflow in URI Parameter Parsing CVSS 4.0HIGH 7.7
TI-2024-28570 An access control issue in NanoMQ v0.21.10 allows attackers to bypass security… CVSS 3.1HIGH 8.8
TI-2026-27853 An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via… CVSS 3.1HIGH 7.5
TI-2026-17589 MQTT v5 Variable Byte Integer parsing out-of-bounds: get_var_integer() CVSS 3.1HIGH 7.5
TI-2024-20452 Null Pointer Dereference vulnerability in topic_filtern function in mqtt_parser.c in… CVSS 3.1HIGH 7.5
TI-2023-17307 NanoMQ 0.16.5 is vulnerable to heap-use-after-free in the nano_ctx_send function of nmq_mqtt.c. CVSS 3.1HIGH 7.5

See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences