CVE-2025-65953 Details
Description
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.22.5, a Heap-Use-After-Free (UAF) vulnerability exists in the TCP transport component of NanoMQ, which relies on the underlying NanoNNG library (specifically in src/sp/transport/mqtt/broker_tcp.c). The vulnerability is due to improper resource management and premature cleanup of message and pipe structures under specific malformed MQTTV5 retain message traffic conditions. This issue has been patched in version 0.22.5.
A Heap-Use-After-Free vulnerability has been identified in the TCP transport component of NanoMQ MQTT Broker, prior to version 0.22.5. This vulnerability arises from improper resource management and premature cleanup of message and pipe structures, particularly under certain conditions involving malformed MQTTV5 retain message traffic. The issue is rooted in the broker's reliance on the NanoNNG library, specifically within the file 'src/sp/transport/mqtt/broker_tcp.c'. An unauthenticated remote attacker can exploit this vulnerability by sending specially crafted packets, leading to a segmentation fault in the broker's process. This exploitation causes the broker to crash, creating a Denial-of-Service condition for all connected clients.
Users can upgrade to NanoMQ version 0.22.5 or later to address this vulnerability. As a workaround, ensure that the Client SDK correctly encodes MQTT V5 messages.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 25, 2025CISA-ADP
Assessed Nov 26, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nanomq/nanomq/security/advisories/GHSA-r95p-wjm8-2qxr | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NanoMQ | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 25, 2025 | New CVE Received | [email protected] |