CVE-2025-59946

NanoMQ before version 0.24.4 has a buffer overflow vulnerability when PUBLISH packets trigger both shared and vanilla subscriptions. This is fixed in version 0.24.4.

In NanoMQ MQTT broker prior to 0.24.14, the nmq_subinfo_decode() function reuses the length variable from the outer Properties Length while parsing each subscription identifier. A remote client can send a SUBSCRIBE packet with a multi-byte Properties Length and repeated subscription identifiers, causing a read beyond the heap message buffer. The issue is fixed in version 0.24.14.

A vulnerability in NanoMQ before 0.24.14 in the client function nni_mqtt_msg_decode_unsubscribe() fails to handle a failed read while counting topics in a malformed UNSUBSCRIBE packet. This can hang a connecting MQTT 3.1.1 client, consume CPU and memory, and repeatedly deny service when auto-reconnect is enabled.

NanoMQ, an MQTT broker, prior to 0.24.14 has an MQTT v5 property decoder that walks the entire linked list for each property added, resulting in O(N²) complexity. A remote unauthenticated client can send a PUBLISH or SUBSCRIBE packet with many User Properties, causing excessive CPU usage and broker unresponsiveness.

In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in `properties_parse()` allows an authenticated attacker to crash the NanoMQ broker by sending a POST request to `/api/v4/mqtt/publish` with `user_properties` as a JSON array instead of a JSON object. The crash occurs because `strlen()` is called on a NULL `item->string` pointer when iterating over array elements.

In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in nni_mqttv5_msg_decode_connect allows a malicious MQTT broker to crash any connecting NanoMQ MQTTv5 client (including bridge mode) with a single packet, causing remote denial of service via SIGSEGV. The issue occurs because the code uses variable 'prop' instead of 'will_prop' when iterating over CONNECT properties.

NanoMQ contains a protocol-semantics flaw in its MQTT v5 SUBSCRIBE handling. If a subscription entry is missing the final 1-byte Subscription Options field, the broker may accept the malformed packet and install the subscription. Under specific conditions, the same parser flaw also causes a 1-byte out-of-bounds read detected by ASAN as a heap-buffer-overflow.

A vulnerability in NanoMQ version 0.24.9 allows a remote attacker to cause a denial of service (DoS) via the nni_qos_db_set function in the broker_tcp.c component.

In NanoMQ MQTT Broker version 0.24.8 and earlier, quic_stream_recv can dereference a null substream pointer when a substream is in reopen state. The code finishes the AIO with error but does not return before locking c->mtx, potentially leading to crashes or other issues.

NanoMQ MQTT Broker before version 0.24.14 has a type confusion vulnerability during dialer close. This leads to incorrect object interpretation and may cause hang or crash.