CVE-2026-21888: 
NixOS vulnerability analysis and mitigation

CVE-2026-21888 is an out-of-bounds read vulnerability in the MQTT v5 Variable Byte Integer (VBI) parser of NanoMQ MQTT Broker, an edge messaging platform developed by EMQX. The get_var_integer() function in mqtt_parser.c incorrectly accepts 5-byte varints without enforcing the MQTT v5 specification's 4-byte maximum, enabling a 1-byte heap-buffer-overflow read that reliably crashes the broker. It affects NanoMQ version 0.24.6 and all earlier releases. The vulnerability was first reported as GitHub Issue #2192 on December 24, 2025, and a security advisory (GHSA-cggc-6m7w-j7x5) was published on March 11, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is an out-of-bounds read (CWE-125) in the get_var_integer() function located in nng/src/sp/protocol/mqtt/mqtt_parser.c (line 179). The MQTT v5 specification mandates that Variable Byte Integers be encoded in at most 4 bytes, but the parsing loop in NanoMQ lacks an explicit bounds check, allowing it to read a 5th byte beyond the allocated buffer. This is triggered during MQTT CONNECT packet processing in conn_handler(), which is called from tcptran_pipe_nego_cb() in the TCP transport layer. An unauthenticated attacker can exploit this by sending a crafted CONNECT packet where the Properties Length field is encoded as four continuation bytes (MSB set), causing a 1-byte heap-buffer-overflow read immediately past the allocated region (GitHub Advisory, GitHub Issue).

Successful exploitation causes the NanoMQ broker process to crash, resulting in a complete denial of service for all connected MQTT clients and any IoT or edge messaging workloads depending on the broker. Because no authentication is required and the vulnerable code path is reached during the initial connection handshake, any network-reachable NanoMQ instance is exposed. There is no confidentiality or integrity impact — the vulnerability is limited to availability — but repeated exploitation can keep the broker continuously unavailable (GitHub Advisory).

A public proof-of-concept exploit is available in the GitHub security advisory, consisting of a concrete malformed MQTT CONNECT packet payload and a single nc command to trigger the crash. The EPSS score is approximately 0.052% (low probability of near-term exploitation), and there is no evidence of active in-the-wild exploitation as of the advisory date. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible NanoMQ MQTT broker instances (default port 1883/TCP) running version 0.24.6 or earlier using tools such as Shodan, Censys, or nmap.
2. Craft malformed CONNECT packet: Prepare a raw MQTT v5 CONNECT packet where the Properties Length field is encoded as four continuation bytes (all with the MSB set, e.g., \x80\x80\x80\x80), exceeding the 4-byte VBI limit defined by the MQTT v5 specification.
3. Send the packet: Transmit the malformed packet directly to the broker's MQTT port using a raw TCP tool:

   printf '\x10\x0E\x00\x04\x4D\x51\x54\x54\x05\x00\x00\x00\x80\x80\x80\x80' | nc <target_ip> 1883

4. Trigger crash: The broker's get_var_integer() function reads a 5th byte past the end of the allocated buffer during conn_handler() processing, causing a heap-buffer-overflow and crashing the broker process, resulting in denial of service for all connected clients (GitHub Advisory, GitHub Issue).

• Network: Unexpected TCP connections to port 1883 from untrusted or external IP addresses; short-lived connections that do not complete a valid MQTT handshake; repeated connection attempts with minimal data transfer (16-byte payloads).
• Logs: NanoMQ broker logs showing abrupt process termination or restart events; ASan-enabled builds will log ERROR: AddressSanitizer: heap-buffer-overflow in mqtt_parser.c:179 in get_var_integer prior to abort.
• Process: Unexpected termination or restart of the nanomq broker process; watchdog or supervisor logs (e.g., systemd) recording repeated nanomq service restarts in a short time window.
• File System: Core dump files generated in the NanoMQ working directory following a crash, if core dumps are enabled on the host (GitHub Advisory).

The security advisory notes the issue has been fixed in the NanoMQ codebase; users should upgrade to a version later than 0.24.6 as soon as a patched release is available. As an interim workaround, implement network-level access controls (firewall rules, VPN, or allowlists) to restrict MQTT port 1883 access to trusted clients only, reducing the attack surface for unauthenticated exploitation. Additionally, monitor broker logs for unexpected crashes or malformed MQTT v5 messages as an early detection measure (GitHub Advisory).

The vulnerability was noted by automated vulnerability tracking services including VulDB, CVEFeed, and TheHackerWire shortly after publication. Social media activity was limited to automated CVE notification accounts on Mastodon. No significant independent researcher commentary or vendor statements beyond the original GitHub advisory have been identified.