NanoMQ MQ­Broker’s webhook_inproc.c routine parses incoming messages with cJSON_Parse, which expects a null-terminated string. The message body obtained through nng_msg_body(msg) is a raw binary buffer that may lack a terminating zero. When the payload size is a power of two that is at least 1024 bytes, the buffer receives no padding, causing cJSON_Parse to read beyond the buffer until it encounters a zero byte. This out‑of‑bounds read can expose contents of adjacent memory or trigger a crash, depending on the data accessed, and constitutes a CWE‑125 weakness. The issue is fixed in release 0.24.10. Affected systems include all NanoMQ releases prior to 0.24.10, as identified in the advisories and the cpe listing for nanomq:nanomq. The name of the product is simply NanoMQ MQTT Broker.

Affected systems include all NanoMQ releases prior to 0.24.10, as identified in the advisories and the cpe listing for nanomq:nanomq. The name of the product is simply NanoMQ MQTT Broker.

Risk and exploitability: The CVSS v3 score is 4.9, indicating moderate severity, while the EPSS score is below 1%, suggesting a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely exploitation requires an attacker to send a specially crafted JSON payload of a power‑of‑two length (≥1024 bytes) to the broker’s webhook interface; the broker must be reachable from the attacking network. Because the attack vector relies on sending payloads of a specific size, the exploitation is feasible but not trivially ubiquitous.