---
id: CVE-2025-59947
title: NanoMQ is a messaging broker/bus for IoT Edge & SDV
summary: >-
  NanoMQ is a messaging broker/bus for IoT Edge & SDV. Versions prior to 0.24.4
  have a buffer overflow case while the PUBLISH packets trigger both shared
  subscription and vanila subscription. This is fixed in version 0.24.4. As a
  workaroun…
severity: critical
cvss: 9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H'
cwe:
  - CWE-120
vendor: emqx
product: nanomq
affected:
  - nanomq < 0.24.4
patched:
  - nanomq 0.24.4
published: '2025-12-15'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-59947'
references:
  - url: >-
      https://github.com/nanomq/nanomq/commit/5f5581054bb92f102cf99251e8af2f43763d457b
    label: security-advisories@github.com
  - url: 'https://github.com/nanomq/nanomq/issues/2110'
    label: security-advisories@github.com
  - url: 'https://github.com/nanomq/nanomq/security/advisories/GHSA-98f4-cmg8-x7f3'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00326
epssPercentile: 0.23875
ingestedAt: '2026-10-14T13:30:58.433Z'
---

## Overview

NanoMQ is a messaging broker/bus for IoT Edge & SDV. Versions prior to 0.24.4 have a buffer overflow case while the PUBLISH packets trigger both shared subscription and vanila subscription. This is fixed in version 0.24.4. As a workaround, disable shared subscription.

## Affected

- `nanomq < 0.24.4`

## Remediation

Upgrade past the affected range:

- `nanomq 0.24.4`