CVE-2026-73863

Name of the Vulnerable Software and Affected Versions NanoMQ versions prior to 0.24.14

Description The broker-side MQTT v5 nmq subinfo decode() function in nng/src/sp/protocol/mqtt/mqtt parser.c reuses len of varint from the outer Properties Length when parsing each SUBSCRIPTION IDENTIFIER. A remote client can send a SUBSCRIBE packet containing a multi-byte Properties Length and repeated subscription identifiers. This causes the get var integer() function to start at an incorrect offset and read beyond the heap message buffer, which can lead to a broker crash.

Recommendations Update to version 0.24.14.