CVE-2025-59947

CRITICAL 9.0CVE-2025-59947 · Published 15/12/2025 · updated 14/10/2026

Package	Affected versions	Patched versions
nanomq emqx	`< 0.24.4`	`0.24.4`

Description

NanoMQ is a messaging broker/bus for IoT Edge & SDV. Versions prior to 0.24.4 have a buffer overflow case while the PUBLISH packets trigger both shared subscription and vanila subscription. This is fixed in version 0.24.4. As a workaround, disable shared subscription.

References

nanomq/nanomq commit 5f55810 · Patch
nanomq/nanomq · Issue Tracking
nanomq/nanomq security advisory · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free