A malformed MQTT packet with an excessively large Remaining Length field is accepted by NanoMQ’s WebSocket transport. The broker copies the requested amount of bytes from the receive buffer without ensuring the buffer actually contains that many bytes, triggering an out‑of‑bounds read that can result in a crash. This is identified as CWE‑125 and delivers a denial‑of‑service effect.

The vulnerability exists in NanoMQ version 0.24.7 and earlier. Versions 0.24.8 and later include the fix. Any deployment of NanoMQ that exposes the MQTT‑over‑WebSocket listener is susceptible.

The CVSS base score is 6.5, indicating a moderate severity. Exploitation requires remote access to the WebSocket port; no authentication is required, so an attacker can send the crafted packet from anywhere that can reach the broker. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalogue, but the combination of a moderate CVSS score and open‑to‑attack vector raises the risk to a significant level.