NanoMQ, an MQTT broker, contains a buffer overrun flaw in its WebSocket transport. A broker receiving an MQTT packet with a Remaining Length field that specifies a large value but whose attached payload is far shorter causes the code to copy too many bytes from the buffer. The unchecked copy leads to an out‑of‑bounds read, which is reported by ASAN as OOB and causes a crash. The crash terminates the broker process, resulting in a denial‑of‑service for any clients that rely on the affected instance. The weakness is identified as CWE‑125.

Vulnerable versions of NanoMQ are any releases earlier than 0.24.8, including all 0.24.x builds up to 0.24.7 and prior major releases. The issue is tracked in GitHub commits and releases and has been fixed in the 0.24.8 release. The product is distributed under the EMQX NanoMQ project, which can be found as the cpe:2.3:a:emqx:nanomq.

With a CVSS base score of 6.5, the vulnerability represents moderate severity. EPSS indicates less than 1% likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. However, because it can be triggered remotely by sending a specifically crafted MQTT packet over the WebSocket listener, an attacker with network access to the broker can induce repeated crashes. The attack requires only the ability to send malformed packets, meaning that exposed brokers in untrusted networks could be an easy target for a denial‑of‑service attack.