CVE-2026-25627: 
NixOS vulnerability analysis and mitigation

CVE-2026-25627 is an out-of-bounds read vulnerability in NanoMQ MQTT Broker's MQTT-over-WebSocket transport that allows unauthenticated remote attackers to crash the broker process, resulting in a Denial of Service. It affects all NanoMQ versions prior to 0.24.8, developed by EMQX. The vulnerability was disclosed on March 30, 2026, and patched in version 0.24.8 released January 9, 2026. It carries a CVSS v3.1 base score of 7.5 (High) per NVD, though the GitHub advisory rates it 6.5 (Moderate) with a low-privilege variant of the vector (GitHub Advisory, Feedly).

The root cause is an out-of-bounds read (CWE-125) in the WebSocket transport layer of NanoMQ, specifically in nng/src/sp/transport/mqttws/nmq_websocket.c within the wstran_pipe_recv_cb() callback and its helper ws_msg_adaptor(). When an MQTT packet is received over WebSocket, the code parses the fixed header's Remaining Length field and then calls nni_msg_append(m, packet + pos, len) using the attacker-controlled len value without verifying that the receive buffer actually contains that many bytes. An attacker can send a valid MQTT CONNECT followed by a malformed PUBLISH packet with a Remaining Length set to a large value (e.g., 4096) while providing only a few bytes of actual payload, causing the code to read past the end of the buffer and crash the process (GitHub Advisory).

Successful exploitation causes the NanoMQ broker process to crash (ASAN-reported OOB read / process termination), resulting in a complete Denial of Service for all connected MQTT clients. Because NanoMQ is commonly deployed as an edge messaging platform in IoT environments, a crash disrupts all message routing and telemetry collection for downstream devices. There is no confidentiality or integrity impact; the vulnerability is limited to availability (GitHub Advisory, Feedly).

A working proof-of-concept Python script is publicly available in the GitHub security advisory, which connects to a live NanoMQ instance and repeatedly sends malformed MQTT PUBLISH packets over WebSocket to trigger the crash. The exploit requires only a valid CONNECT packet followed by the malformed PUBLISH, making it trivially reproducible by unauthenticated attackers. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.013% (0.000130), indicating low current exploitation probability (GitHub Advisory, Feedly).

1. Reconnaissance: Identify NanoMQ instances with the WebSocket listener exposed (default port 8083) using network scanners such as Shodan, Censys, or nmap targeting 8083/tcp.
2. Establish WebSocket connection: Connect to the target's WebSocket MQTT endpoint (e.g., ws://<target>:8083/mqtt) using the mqtt subprotocol.
3. Send valid CONNECT packet: Transmit a well-formed MQTT CONNECT packet to establish a session with the broker (required before sending PUBLISH).
4. Craft malformed PUBLISH packet: Build an MQTT PUBLISH packet with a Remaining Length field set to a large value (e.g., 4096) encoded as a variable-length integer, but include only a minimal payload body (e.g., 3 bytes: topic length \x00\x01 + topic a).
5. Trigger OOB read: Send the malformed PUBLISH packet (repeatedly if needed) over the WebSocket connection. The broker's ws_msg_adaptor() function will attempt to copy 4096 bytes from a buffer containing only 3 bytes, triggering an out-of-bounds read and crashing the process.
6. Confirm DoS: Verify the broker is unresponsive to new connections or messages, confirming successful denial of service (GitHub Advisory).

• Network: Repeated WebSocket connections to port 8083 from a single or rotating source IP, particularly connections that send a CONNECT followed immediately by PUBLISH packets with anomalously large Remaining Length values (e.g., >1024) but very short actual payloads.
• Process: Unexpected termination or restart of the nanomq process; crash dumps or core files generated in the NanoMQ working directory.
• Logs: ASAN output in NanoMQ logs indicating heap-buffer-overflow or out-of-bounds read in ws_msg_adaptor() or wstran_pipe_recv_cb(); broker log entries showing abrupt disconnection of all clients coinciding with a WebSocket session.
• File System: Presence of ASAN report files (e.g., report3_ASAN.txt) or core dump files in the NanoMQ installation directory following a crash (GitHub Advisory).

Upgrade NanoMQ to version 0.24.8 or later, which includes the fix for this vulnerability via the patch in NanoNNG commit e80b30b (NanoMQ Release, Patch Commit). If immediate patching is not possible, restrict network access to the WebSocket listener (default port 8083) to trusted clients only using firewall rules or network segmentation. Enabling authentication on the MQTT broker can raise the bar slightly (requiring a valid CONNECT), but does not prevent exploitation since the vulnerability is triggered after a valid CONNECT (GitHub Advisory).