Read the docs
TI-2025-40549 Aliases CVE-2025-66023

NanoMQ has Use-After-Free of malformed bridging message

Priority LOW 31CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Versions prior to 0.24.5 have a Heap-Use-After-Free (UAF) vulnerability within the MQTT bridge client component (implemented via the underlying NanoNNG library). The vulnerability is triggered when NanoMQ acts as a bridge connecting to a remote MQTT broker. A malicious remote broker can trigger a crash (Denial of Service) or potential memory corruption by accepting the connection and immediately sending a malformed packet sequence. Version 0.34.5 contains a patch. The patch enforces stricter protocol adherence in the MQTT client SDK embedded in NanoMQ. Specifically, it ensures that CONNACK is always the first packet processed in the line. This prevents the state confusion that led to the Heap-Use-After-Free (UAF) when a malicious server sent a malformed packet sequence immediately after connection establishment. As a workaround, validate the remote broker before bridging.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00369 30th percentileScored 2026-11-07
Fix Fixed nanomq (nanomq): 0.24.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nanomqnanomqbefore 0.24.50.24.5Patch availableCNA
  • nanomq Vendornanomq Affected before 0.24.5 Fixed in 0.24.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:emqx:nanomq:*:*:*:*:*:*:*:*before 0.24.5Vulnerablenanomq
  • cpe:2.3:a:emqx:nanomq:*:*:*:*:*:*:*:* Versions before 0.24.5 Vulnerable ·nanomq

Remediation

  • Fix · CNA nanomq (nanomq) Fixed in 0.24.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66023

References

Patch 1

Advisory 1

Other 1

  • TI-2026-24672 NanoMQ has Heap Buffer Overflow in URI Parameter Parsing CVSS 4.0HIGH 7.7
  • TI-2024-28570 An access control issue in NanoMQ v0.21.10 allows attackers to bypass security… CVSS 3.1HIGH 8.8
  • TI-2026-27853 An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via… CVSS 3.1HIGH 7.5
  • TI-2026-17589 MQTT v5 Variable Byte Integer parsing out-of-bounds: get_var_integer() CVSS 3.1HIGH 7.5
  • TI-2024-20452 Null Pointer Dereference vulnerability in topic_filtern function in mqtt_parser.c in… CVSS 3.1HIGH 7.5
  • TI-2023-17307 NanoMQ 0.16.5 is vulnerable to heap-use-after-free in the nano_ctx_send function of nmq_mqtt.c. CVSS 3.1HIGH 7.5
See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences