# nanomq. Every CVE that names nanomq among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [NanoMQ: Heap-Buffer-Overflow in \`nmq_subinfo_decode()\` During MQTT v5 SUBSCRIBE Parsing](https://agentprime.io/advisories/CVE-2026-73863.md) `CVE-2026-73863` · CVE record: nanomq nanomq · CVSS 7.0 High · Not analysed yet · Published 18 Sept 2026 · Tags: Memory corruption - [NanoMQ: Infinite Loop in UNSUBSCRIBE Decoder Leading to Remote DoS](https://agentprime.io/advisories/CVE-2026-61633.md) `CVE-2026-61633` · CVE record: nanomq nanomq · CVSS 2.0 Low · Not analysed yet · Published 18 Sept 2026 · Tags: Denial of service - [NanoMQ: O(N²) Denial of Service in MQTT v5 Property Parsing](https://agentprime.io/advisories/CVE-2026-44639.md) `CVE-2026-44639` · CVE record: nanomq nanomq · CVSS 3.7 Low · Not analysed yet · Published 18 Sept 2026 · Tags: Denial of service - [NULL Pointer Dereference in REST API properties_parse via Malformed user_properties](https://agentprime.io/advisories/CVE-2026-47276.md) `CVE-2026-47276` · CVE record: nanomq nanomq · CVSS 6.5 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Memory corruption - [nanomq NULL Pointer Dereference in MQTTv5 Client CONNECT Decoder Leading to Remote DoS](https://agentprime.io/advisories/CVE-2026-47275.md) `CVE-2026-47275` · CVE record: nanomq nanomq · CVSS 2.6 Low · Not analysed yet · Published 20 Jul 2026 · Tags: Memory corruption - [NanoMQ Incorrectly Accepts a Malformed SUBSCRIBE and Can Be Driven into an ASAN-Detectable Out-of-Bounds Read](https://agentprime.io/advisories/CVE-2026-35217.md) `CVE-2026-35217` · CVE record: nanomq nanomq · CVSS 6.5 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Memory corruption - [NanoMQ: NULL Pointer Dereference](https://agentprime.io/advisories/CVE-2026-45151.md) `CVE-2026-45151` · CVE record: nanomq nanomq · CVSS 2.9 Low · Not analysed yet · Published 29 May 2026 · Tags: Memory corruption - [NanoMQ: QUIC Dialer Close Type Confusion](https://agentprime.io/advisories/CVE-2026-44640.md) `CVE-2026-44640` · CVE record: nanomq nanomq · CVSS 4.5 Medium · Not analysed yet · Published 29 May 2026 · Tags: Memory corruption - [NanoMQ: NULL Pointer Dereference Crash in tcptran_pipe_peer During Session Restore](https://agentprime.io/advisories/CVE-2026-32134.md) `CVE-2026-32134` · CVE record: nanomq nanomq and 1 more · CVSS 5.9 Medium · Not analysed yet · Published 19 May 2026 · Tags: Memory corruption - [NanoMQ has Heap Buffer Overflow in URI Parameter Parsing](https://agentprime.io/advisories/CVE-2026-32135.md) `CVE-2026-32135` · CVE record: nanomq nanomq · CVSS 7.7 High · Not analysed yet · Published 20 Apr 2026 · Tags: Memory corruption - [nanomq: Heap-Buffer-Overflow in webhook_inproc.c via cJSON_Parse OOB Read](https://agentprime.io/advisories/CVE-2026-34608.md) `CVE-2026-34608` · CVE record: nanomq nanomq · CVSS 4.9 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: Memory corruption - [NanoMQ HTTP Auth: Missing username/password can trigger a NULL-pointer strlen() in auth_http.c:set_data(), causing a process crash — SIGSEGV, remotely triggerable](https://agentprime.io/advisories/CVE-2026-32696.md) `CVE-2026-32696` · CVE record: nanomq nanomq · CVSS 3.1 Low · Not analysed yet · Published 30 Mar 2026 · Tags: Memory corruption - [nanomq: OOB Read / Crash (DoS) via Malformed MQTT Remaining Length over WebSocket](https://agentprime.io/advisories/CVE-2026-25627.md) `CVE-2026-25627` · CVE record: nanomq nanomq · CVSS 6.5 Medium · Not analysed yet · Published 30 Mar 2026 · Tags: Memory corruption - [MQTT v5 Variable Byte Integer parsing out-of-bounds: get_var_integer()](https://agentprime.io/advisories/CVE-2026-21888.md) `CVE-2026-21888` · CVE record: nanomq nanomq · CVSS 7.5 High · Not analysed yet · Published 11 Mar 2026 · Tags: Memory corruption - [NanoMQ 0.24.6 Use-After-Free Leading to Heap Corruption and Broker Crash](https://agentprime.io/advisories/CVE-2026-22040.md) `CVE-2026-22040` · CVE record: nanomq nanomq · CVSS 5.3 Medium · Not analysed yet · Published 4 Mar 2026 · Tags: Memory corruption - [NanoMQ $share/ Subscription Validation and Forwarding Parsing Inconsistency: NULL Pointer Increment Causes Crash](https://agentprime.io/advisories/CVE-2025-68699.md) `CVE-2025-68699` · CVE record: nanomq nanomq · CVSS 6.5 Medium · Not analysed yet · Published 4 Feb 2026 · Tags: Memory corruption - [NanoMQ has Use-After-Free of malformed bridging message](https://agentprime.io/advisories/CVE-2025-66023.md) `CVE-2025-66023` · CVE record: nanomq nanomq · CVSS 6.9 Medium · Not analysed yet · Published 1 Jan 2026 · Tags: Memory corruption - [NanoMQ has a Use After Free vulnerability via sub info list](https://agentprime.io/advisories/CVE-2025-59946.md) `CVE-2025-59946` · CVE record: nanomq nanomq · CVSS 7.5 High · Not analysed yet · Published 27 Dec 2025 · Tags: Memory corruption - [NanoMQ has Buffer Overflow](https://agentprime.io/advisories/CVE-2025-59947.md) `CVE-2025-59947` · CVE record: nanomq nanomq · CVSS 8.5 High · Not analysed yet · Published 15 Dec 2025 · Tags: Memory corruption - [NanoMQ UAF of retain message due to invalid MQTTV5 properties](https://agentprime.io/advisories/CVE-2025-65953.md) `CVE-2025-65953` · CVE record: nanomq nanomq · CVSS 6.0 Medium · Not analysed yet · Published 25 Nov 2025 · Tags: Memory corruption ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .