The flaw is a NULL pointer dereference in the NanoMQ function properties_parse. When a client sends a POST request to /api/v4/mqtt/publish with the field user_properties set as a JSON array instead of the expected JSON object, the code calls strlen on a NULL pointer within an array element, causing the broker to crash. This is a classic NULL pointer dereference that simply terminates the process.

NanoMQ versions 0.24.11 and earlier are vulnerable; the issue is fixed in version 0.24.14. No other products are known to be affected.

The CVSS score of 6.5 indicates a moderate impact. The EPSS score of <1% indicates a very low likelihood of exploitation. The attack requires an authenticated session to the broker, meaning it limited to users with valid credentials. An attacker can induce a denial‑of‑service condition by sending a crafted request, but cannot gain code execution or data exfiltration. The vulnerability is not listed in CISA KEV. Ideally, the broker should be patched or the input should be validated to prevent the crash.