CVE-2025-59947

Critical

Published: 15/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

NanoMQ before version 0.24.4 has a buffer overflow vulnerability when PUBLISH packets trigger both shared and vanilla subscriptions. This is fixed in version 0.24.4.

Risk Assessment

Buffer overflow can lead to broker crashes or remote code execution, potentially disrupting IoT and SDV systems.

Recommendation

Upgrade NanoMQ to version 0.24.4 or later. As a workaround, disable shared subscription.

Original NVD description (English source)

NanoMQ is a messaging broker/bus for IoT Edge & SDV. Versions prior to 0.24.4 have a buffer overflow case while the PUBLISH packets trigger both shared subscription and vanila subscription. This is fixed in version 0.24.4. As a workaround, disable shared subscription.