Grant-Yim

**Name of the Vulnerable Software and Affected Versions** NanoMQ versions prior to 0.24.14 **Description** A type confusion occurs when `aio->prov data` is stored as `nni quic conn*` during the dialing process but is subsequently read as `ex quic conn*` during the dialer close. This discrepancy leads to invalid object interpretation, resulting in a hang or crash during the close-path execution. **Recommendations** Update to version 0.24.14.

**Name of the Vulnerable Software and Affected Versions** NanoMQ versions prior to 0.24.9 **Description** NanoMQ is an Edge Messaging Platform. A null pointer dereference can occur in the `quic stream recv()` function when a substream is in a reopen state. The system completes the Asynchronous I/O (AIO) operation with an error but fails to return before attempting to lock the `c->mtx` variable. **Recommendations** Update to a version later than 0.24.8.

**Name of the Vulnerable Software and Affected Versions** NanoMQ versions prior to 0.24.10 **Description** In the `webhook inproc.c` file, the `hook work cb()` function processes nng messages by parsing the message body using `cJSON Parse(body)`. Because the body is retrieved via `nng msg body(msg)` as a binary buffer without a guaranteed null terminator, an out-of-bounds read (OOB read) occurs. This happens because `cJSON Parse` continues reading memory until it encounters a null terminator, potentially accessing memory beyond the allocated buffer, such as nng msg metadata or adjacent heap/stack memory. This issue is reliably triggered when the JSON payload length is a power-of-two greater than or equal to 1024, as no allocation padding is added in those cases. **Recommendations** Update to version 0.24.10.

**Name of the Vulnerable Software and Affected Versions** NanoMQ versions prior to 0.24.8 **Description** NanoMQ MQTT Broker is an Edge Messaging Platform. Before version 0.24.8, the MQTT-over-WebSocket transport in NanoMQ could be crashed by sending an MQTT packet with a deliberately large Remaining Length in the fixed header while providing a much shorter actual payload. The code copies bytes of the Remaining Length without verifying that the current receive buffer contains that many bytes, resulting in an out-of-bounds read. This can be triggered remotely through the WebSocket listener. **Recommendations** Update NanoMQ to version 0.24.8 or later.